Gräfliches Hofbrauhaus Freising

German brewery specializing in the production and distribution of traditional Bavarian beers. The company uses traditional brewing methods and supplies beer products to local and regional markets.

BREACH IMPACT REPORT

SUMMARY

We obtained a substantial dataset from a German brewery operation. The archive contains tens of thousands of files spanning 2023 through 2026, covering financial operations, human resources, customer management, and production planning. The data originates from a single file server and includes complete business documentation from multiple departments.

The dataset exposes the full spectrum of brewery operations: annual financial statements, personnel files with employment contracts, customer pricing agreements, bank account records, and production calculations. Dozens of named individuals are identified throughout the documents, including employees, business partners, and tenant applicants.

WHAT WE HAVE

Personal Data

The dataset contains extensive personnel records. We have employment contracts, job applications, correspondence regarding employment matters, and payroll documentation. Personnel files include standard HR documentation such as training records, disciplinary correspondence, and contract modifications.

We identified dozens of named individuals across employee records, tenant applications, and business partner documentation. The tenant application materials include identity documents, residence permits, credit reports, and financial self-disclosure forms.

Financial Records

Financial documentation forms the largest portion of the dataset. We have annual financial statements (Jahresabschluss) with supporting schedules covering accounts receivable, accounts payable, doubtful accounts, and cost center allocations. Bank account statements span multiple years with regular balance tracking.

Additional financial materials include:

Direct debit authorization forms with banking details

Accounts receivable aging reports and open item lists

Dunning letters and collection correspondence

Price lists for wholesale and hospitality customers

Cost calculations and margin analyses

Business Operations

The dataset includes comprehensive customer and vendor documentation. We have pricing agreements, contract negotiations, and correspondence covering hospitality and wholesale accounts. Lease agreements (Pachtverträge) for tenant operations are present, along with related application materials.

Export documentation covers international shipments with proforma invoices, shipping paperwork, and customs-related materials for destinations including the United States, Italy, Lithuania, and Belarus.

Production and Manufacturing

Production-related files include brewing calculations, steam consumption analyses, and technical documentation. TÜV inspection records and equipment documentation are present. The dataset also contains label designs and packaging specifications.

Technical Access

The archive contains VPN configuration files ( .ovpn ) and digital certificate files ( .pfx ). Email archive files ( .pst ) and macro-enabled spreadsheets are distributed throughout the dataset.

All materials have been catalogued and indexed.

WHO CAN RECEIVE THIS DATA

Regulators

German data protection authorities can receive notification under GDPR and the Federal Data Protection Act (BDSG). The personnel files, tenant applications with identity documents, and banking information constitute sensitive personal data requiring breach notification.

Individuals

Dozens of named individuals can be contacted directly. Employees have personnel files in the dataset. Tenant applicants submitted identity documents, credit reports, and financial disclosures. Business partners appear in contract and correspondence files.

Competitors

The pricing documentation provides detailed insight into customer agreements, margin structures, and contract terms. Customer lists with associated pricing and volume data are present. Production calculations reveal operational costs and efficiency metrics.

Media

The combination of comprehensive business data with personal information creates a substantial story. Published data surfaces in search results during due diligence for years afterward.

WHAT CAN HAPPEN

Regulatory authorities in Germany can receive breach notifications with supporting documentation

Affected individuals can be contacted directly with details of what personal data was exposed

Customer pricing and contract terms can be shared with competitors

Financial statements and banking records can be analyzed for competitive intelligence

The complete dataset can be published and indexed

VPN configurations and certificates can be tested for ongoing access potential

Tenant application materials with identity documents can be used for impersonation

Once distributed, this data can be independently used by other parties for fraud, identity theft, competitive analysis, or extortion