The aurora ransomware group listed Allmand-Smith Limited on its data leak site on 2026-10-21. Country: GB Sector: Manufacturing Domains named: blfw.db, details.xlsx Claim as published on the leak site: [distributor, manufacturer] Allmand-Smith Limited (trading as Stormguard) — a UK manufacturer and distributor of building products headquartered in Stoke-on-Trent. Domain admin credentials in plaintext and a full DC dump — STORMGUARD\MichaelAdmin / 5t0rmGuard Complete NatWest banking infrastructure — blfw.db (21.3 MB live Bankline database with account numbers, sort codes, payee details, and transaction logs), plus WorldPay payment gateway credentials (WorldPay Account Details.xlsx), plus Sage
Allmand-Smith Limited listed by aurora ransomware group
- Group
- aurora
- Sector
- Manufacturing
- Country
- United Kingdom
- First seen
- 21 October 2026
This is a claim published by the threat group itself and has not been independently verified. OffSet7 does not host or link to any leaked data.
Monitor your company and suppliers
Get an alert the moment a ransomware group names your company or one of your suppliers.