Lanxess Internal Data - 14k Users

[STA6]

Greetings, DNA.​

Lanxess is a German specialty chemicals multinational headquartered in Cologne, Germany. Established in 2004 from the reorganization of Bayer AG's chemicals and polymers divisions.
We spent weeks at the negotiating table in good faith; they chose to break their word and ignore their commitments.

The compromised material obtained includes the following categories:

*14,658 users
• All 14,658 rows contain an email address
• 11,860 rows contain a 32-char hex password hash (MD5)
• Fields include: USERNAME, PASSWORD, EMAIL, FIRSTNAME, LASTNAME, COMPANY, ADDRESS1/2, CITY, COUNTRY, PHONE, FAX, DEPARTMENT, JOBFUNCTION, STATE,
LOGIN_COUNT
• Mostly @lanxess.com corporate emails plus external business partners
• Sample row: kusuh — MD5 hash — Manfred Suhl, LANXESS, Krefeld/Dormagen, with phone number

*TLS private keys
• wildcard.lanxess.com.key
• star_lanxess_com.key
• tecci.lanxess.com.2048.2025.key and tecci.lanxess.com.key
• lanxess.key
• techcenter.lanxess.com.2025.key
• Full historical SSL key/cert collection (2011–2025), including teccilax.werum.de.key recovered from SVN metadata
• sensitive.tgz and sensitive2.tgz — archives bundling all of the above

Cleartext credentials
• tomcat-users.xml — admin/prod: Erbse12dmZ, prodinExport: Lex99us (two copies)
• ROOT.xml — Oracle datasource credentials (lax_tc_live, lax_tc_app, etc.)
• keystore.dat
• hibernate.cfg.xml (6 files)
• SystemGlobals.properties and jforum-custom.conf

User data (PII + password hashes)
• Users — full JD_USER dump: 236 users (170 active) with password hash, name, and @lanxess.com email
• oracle_jduser_full_2026-08-16.txt — same Oracle dump
• oracle_dump_2026-08-16.txt
• oracle_live_schema_privs_2026-08-16.txt

Internal LANXESS contact mailboxes (146 rows)
• Maps region/service → internal @lanxess.com addresses (e.g. durethan-pocan@lanxess.com, victor.nasreddine@lanxess.com)
• It's the internal routing table for product enquiries, organized by region and product branch

12,249 enquiry emails received by LANXESS
• Full message metadata + content: MAIL_TO, sender name, COMPANY, ZIP_CODE, CITY, COUNTRY, E_MAIL, PHONE, PRODUCT, QUESTION_TEXT (the actual
message body), SEND_STATUS
• Contains PII of ~12k external customers/contacts (names, corporate emails, phone numbers) plus what they asked about — real business

Sample Proof
Gofile — Cloud Storage Made Simple
Pass: G5XXlan

Contact
Secure communication is recommended.

qTox ID: 204632B48A581ED50BE12C30645989962FEC3C25560B5F2C761BB7BDB5CA150A60FF50D907CF
Telegram @Tpofx

 

[Frankfurter72]

Thank you