FuG-Gruppe

A German IT systems integrator and general contractor (Systemhaus) based in Halver, North Rhine-Westphalia (NRW), founded in 1950. The company specializes in IT/EDP integration and ERP solutions for industrial businesses, steel trading companies

Breach Impact Report

SUMMARY

We obtained a substantial dataset from a German IT service provider. The archive contains several thousand files spanning 2023 through 2026, covering client operations, financial administration, and internal infrastructure. The data is structured across multiple network shares and includes accounting records, client contracts, employee documentation, and cryptographic materials.

The dataset reveals an organization managing IT infrastructure and software solutions for clients in the beverage distribution and manufacturing sectors. Files include client correspondence, system configurations, and administrative records. A handful of named individuals are identified throughout the materials.

WHAT WE HAVE

Personal Data

Employee records are present in the dataset. We identified personnel files, wage documentation, and identity documents. Travel expense records and contact directories are included.

The dataset contains:

Employee documentation and personnel files

Identity card scans

Wage and salary records

Travel expense reports

Contact directories with personal information

This data enables direct identification of staff members and their compensation details.

Financial Records

Several thousand financial documents form the core of the dataset. We obtained invoices, payment records, and accounting exports. The materials span multiple fiscal years and include banking documentation.

The financial archive includes complete invoice sequences with sequential numbering, payment authorizations, and bank account details.

Specific holdings:

Outgoing invoices with client names and amounts

Payment and direct debit records

Bank statements

DATEV accounting exports and booking records

Dunning correspondence

Legal & Contracts

Contractual documentation is extensive. We obtained leasing agreements, rental contracts, and termination correspondence. Legal communications with attorneys are present.

The legal materials include:

Leasing and financing agreements

Software rental contracts

Contract termination letters and confirmations

Correspondence with legal counsel

SEPA direct debit mandates with banking authorizations

Manufacturing & Operations

Production-related documentation is included. Manufacturing orders, service hour statements, and performance records detail operational activities.

Operational data includes:

Production order documentation

Service hour statements and billing records

Performance verification documents

Digital Certificates & Infrastructure Access

Over a thousand cryptographic files were extracted. We obtained digital certificates, private keys, and VPN configurations.

The certificate archive includes .pfx files, .pem private keys, and certificate signing requests for multiple client domains.

Infrastructure materials:

Email signing certificates with private keys

VPN configuration files ( .ovpn )

Keystore files

Certificate signing requests

These materials provide the ability to impersonate legitimate email addresses and potentially access protected systems.

Intellectual Property & Business Intelligence

Pricing documentation and customer data are included. We obtained price lists, calculation sheets, and customer directories.

Business intelligence materials:

Internal price lists and partner pricing

Calculation sheets for client proposals

Customer lists and contact information

Service pricing documentation

WHO CAN RECEIVE THIS DATA

Regulators

German data protection authorities can be notified. The dataset contains personal data subject to GDPR, including employee records, identity documents, and financial information. The presence of unencrypted private keys and certificates raises questions about data protection compliance.

Individuals

A handful of named individuals can be directly contacted. Their personal information, including identity documents and compensation details, is present in the dataset.

Competitors

Pricing data and customer lists provide competitive intelligence. Any party obtaining this information gains insight into pricing strategies, client relationships, and operational methods.

Media

The combination of certificate exposure, employee data, and client financial records presents a clear narrative about security practices at an IT service provider.

WHAT CAN HAPPEN

The complete dataset can be transmitted to the Bavarian data protection authority (BayLDA) for regulatory review

Named individuals can receive direct notification that their personal data is in circulation

Digital certificates can be used to impersonate legitimate email addresses for fraud or phishing operations

VPN configurations can provide access to internal networks if still active

Pricing data can be shared with competitors, undermining business relationships

Client financial information can be used for targeted fraud or social engineering

The full archive can be published on leak sites, indexed by search engines, and permanently associated with this organization

Once published, other threat actors, fraud groups, and identity thieves can independently access and exploit the materials