Planungsgruppe M+M AG
● Listed in the last 48hAbout the organisation
Planungsgruppe M+M AG is a German Aktiengesellschaft headquartered in Böblingen, Baden-Württemberg, with approximately 432 employees across 10 offices (Böblingen, Stuttgart, München, Nürnberg, Regensburg, Ingolstadt, Augsburg, Esslingen, Mannheim, Frankfurt). Annual revenue: approximately €52 million. The firm provides architecture, urban planning, structural engineering, building physics, fire protection, BIM, landscape planning, and interior design services. Over 5,200 projects completed across decades of operation. The exfiltrated dataset spans two complete file servers (MMBB04, MMBB05), plus the DATEV financial processing archives, SFirm banking software databases, the ELO document management system, Outlook email archives (PSTs), and payroll/HR data — a total of 268 GB across approximately 124,000 files, covering 2006 to 2026.
What the listing means
Planungsgruppe M+M AG appeared on the aurora leak site on 17 August 2026. Groups publish a victim once negotiations stall or as pressure during them, so a listing usually means data was already exfiltrated. This group has published 10 claims in the last 30 days and remains active.
Recommended actions
- Treat any unsolicited message referencing Planungsgruppe M+M AG as suspicious — leaked data gets weaponised for phishing within days.
- If you hold an account on dieplanungsgruppe.de, change that password now, update it anywhere you reused it, and enable two-factor authentication.
- Other Professional Services organisations should review this group's known TTPs and validate detection coverage against them.
- Watch for follow-on extortion: stolen data is often re-leaked or resold after the initial listing.
- A leak-site listing is a claim made by the attacker, not a confirmed breach — check the organisation's own disclosures before acting on it.
Leak-site evidence
Listing URL https://www.ransomware.live/id/UGxhbnVuZ3NncnVwcGUgTStNIEFHQGF1cm9yYQ==
Show leak-site screenshot
Captured from the group's extortion site. It may contain the victim's data or the attacker's messaging.
