Pyramid Analytics B.V.

Pyramid Analytics B.V. was compromised in a ransomware attack attributed to Aurora in July 2026. The organization, operating in the Technology sector in Netherlands, was added to the group's data leak site as part of an extortion campaign.

Aurora operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands.

Pyramid Analytics B.V. — a decision-intelligence platform company headquartered in Amsterdam, acquired by ServiceNow (NYSE: NOW) for hundreds of millions of dollars just four months earlier. We obtained the complete source code of the Pyramid Decision Intelligence Platform along with: 10+ copies of the platform source code with full Git history, revealing every feature, algorithm, security module, and AI integration ever built. <censored> <censored> 22 GB of SQL Server production database backups likely containing user accounts, credentials, and business data. Customer data from publicly traded companies — Shufersal (TASE: SAE) retail sales data and ABB (NYSE: ABB) OLAP cube backups. <censored> <censored>