INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Aurora Publishes New Victim The Buckner Company Inc

| 2026-10-13 07:27 CRITICAL HIGH RANSOMWARE & EXTORTION
JSON
Executive Summary
AI-generated
On October 13, 2026, a ransomware attack was launched against The Buckner Company, Inc., a commercial property & casualty insurance brokerage headquartered in Salt Lake City, Utah. The attackers are believed to be behind the operation, although no specific attribution has been made at this time. The targeted sector is finance and the cyber operations involved exfiltration and ransomware tactics. The malware payload used was Hydraq, while the identified entities affected include Google, Chubb, Sedgwick, TBC, TBI, COL, Paycom, BroadStreet Partners, Disclosure Schedules, Outlook PST, and Total Compensation. A total of 1,500+ plaintext credentials were exfiltrated, including Chrome, Edge, and Google password exports from over 8 employees, as well as employee SSNs for approximately 150-250 individuals spanning four tax years (2019–2022). The attackers also obtained corporate tax returns, driver license scans, and email archives.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
HydraqHydraq
Target & Sectors
Global Scope financefinance
Incident Timeline
‎2004–2024
Threat actors accessed and published corporate tax returns for Buckner Company, Inc., Citrus Insurance LLC, and Consolidated Agencies between 2004-2023.
organisation Citrus Insurance LLC
Corporate tax returns for Buckner (2004–2024), Citrus Insurance LLC (2021–2023), and Consolidated Agencies (2022–2023).
attribution Consolidated Agencies
Corporate tax returns for Buckner (2004–2024), Citrus Insurance LLC (2021–2023), and Consolidated Agencies (2022–2023).
‎2026/10/13
Aurora has published a new victim, The Buckner Company, Inc., which includes 1,500+ plaintext credentials and sensitive employee data.
organisation The Buckner Company, Inc
🏴‍☠️ Aurora has just published a new victim : The Buckner Company, Inc.. Description: [insurance] The Buckner Company, Inc. is a commercial property & casualty insurance brokerage headquartered in Salt Lake City, Utah, with a second office in Denver, Colorado.
organisation The Buckner Company, Inc.
🏴‍☠️ Aurora has just published a new victim : The Buckner Company, Inc.. Description: [insurance] The Buckner Company, Inc. is a commercial property & casualty insurance brokerage headquartered in Salt Lake City, Utah, with a second office in Denver, Colorado.
organisation Google
The exfiltrated dataset includes: 1,500+ plaintext credentials — Chrome, Edge, and Google password exports from 8+ employees, plus 20+ password spreadsheets.
data_breach 1,500 credentials
The exfiltrated dataset includes: 1,500+ plaintext credentials — Chrome, Edge, and Google password exports from 8+ employees, plus 20+ password spreadsheets.
organisation Chubb
Verified: kbennett’s file alone contains 503 entries covering Hartford, Travelers, Chubb, Progressive, Sedgwick, mortgage portals, banking, and personal accounts.
organisation Sedgwick
Verified: kbennett’s file alone contains 503 entries covering Hartford, Travelers, Chubb, Progressive, Sedgwick, mortgage portals, banking, and personal accounts.
organisation TBC
Employee SSNs for 150–250 individuals — W-2 reports across three entities (TBC, TBI, COL) spanning four tax years (2019–2022), plus 2023 W-2 and 1099-NEC reports.
organisation TBI
Employee SSNs for 150–250 individuals — W-2 reports across three entities (TBC, TBI, COL) spanning four tax years (2019–2022), plus 2023 W-2 and 1099-NEC reports.
organisation COL
Employee SSNs for 150–250 individuals — W-2 reports across three entities (TBC, TBI, COL) spanning four tax years (2019–2022), plus 2023 W-2 and 1099-NEC reports.
organisation NEC
Employee SSNs for 150–250 individuals — W-2 reports across three entities (TBC, TBI, COL) spanning four tax years (2019–2022), plus 2023 W-2 and 1099-NEC reports.
organisation Total Compensation
316 individual Total Compensation PDFs and 3+ years of Paycom payroll rate history — every employee’s salary, bonus, and benefits laid bare.
organisation Paycom
316 individual Total Compensation PDFs and 3+ years of Paycom payroll rate history — every employee’s salary, bonus, and benefits laid bare.
organisation BroadStreet Partners
A complete M&A acquisition pipeline — 60+ prospect folders with due diligence, LOIs, valuations, and the full BroadStreet Partners closing package (52 exhibits including Disclosure Schedules, MIPA, corporate structure documents).
organisation Disclosure Schedules
A complete M&A acquisition pipeline — 60+ prospect folders with due diligence, LOIs, valuations, and the full BroadStreet Partners closing package (52 exhibits including Disclosure Schedules, MIPA, corporate structure documents).
organisation Outlook PST
128 Outlook PST email archives spanning years of business correspondence.
Tactical Metrics
Metrics
data_breach
1,500
Credentials
The exfiltrated dataset includes: 1,500+ plaintext credentials — Chrome, Edge, and Google password exports from 8+ employees, plus 20+ password spreadsheets.
Intelligence Sources
Ransomware Live 2026-10-13