INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Aurora Publishes New Victim Buford-Thompson Company LTD

| 2026-09-30 16:55 LOW LOW RANSOMWARE & EXTORTION
JSON
Executive Summary
AI-generated
A major ransomware attack occurred on September 30, 2026, targeting Buford-Thompson Company, LTD, a Texas construction general contractor with over 30 years of history. The exposed dataset totals 1.707 TB and includes sensitive information such as plaintext Social Security numbers for 350+ current and former employees, attorney-client privileged files from the Stanton ISD v. BTC litigation, complete Frost Bank infrastructure, donor records from Human Services Campus, and QuickBooks company files containing accounting data. The attack is classified as an exfiltration tactic with ransomware being used as the malware payload. This incident highlights a significant breach of sensitive information, including Social Security numbers and attorney-client communications, affecting multiple organizations involved in construction projects across Texas.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
ra•••••.live
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
AuroraAurora
Target & Sectors
Global Scope educationeducation legallegal
Incident Timeline
‎April 2026
Threat actors used publicly visible information posted by ransomware operators and open web sources to index sensitive data from the targeted entities.
organisation Complete Frost Bank
Complete Frost Bank infrastructure — four account numbers, ACH routing credentials, line-of-credit agreements (renewed April 2026), signature cards, and monthly bank statements spanning 2022–2026.
organisation ISD
36+ active school construction projects — blueprints, bid estimates, cost structures, subcontractor pricing, and change orders for ISD projects across Texas.
organisation Human Services Campus
2,000+ donor records from Human Services Campus (Phoenix homeless-services nonprofit) with full PII: name, address, phone, email, employer, and donation amounts.
organisation PII
2,000+ donor records from Human Services Campus (Phoenix homeless-services nonprofit) with full PII: name, address, phone, email, employer, and donation amounts.
organisation QuickBooks
QuickBooks company files (.QBW) from Along Side Ministries (Phoenix prison ministry) containing complete accounting, donor, and likely payroll data.
organisation Along Side Ministries
QuickBooks company files (.QBW) from Along Side Ministries (Phoenix prison ministry) containing complete accounting, donor, and likely payroll data.
‎2026/09/30
Threat actors used Aurora to publish 9.3 GB of attorney-client privileged files from the Stanton ISD v. BTC litigation, exposing plaintext Social Security numbers and other sensitive employee data for over 350 individuals.
infrastructure 9.3
9.3 GB of attorney-client privileged files from the Stanton ISD v. BTC litigation — legal strategy, discovery responses, and counsel communications.
organisation Stanton ISD
9.3 GB of attorney-client privileged files from the Stanton ISD v. BTC litigation — legal strategy, discovery responses, and counsel communications.
organisation BTC
9.3 GB of attorney-client privileged files from the Stanton ISD v. BTC litigation — legal strategy, discovery responses, and counsel communications.
data_breach 9.3 GB
9.3 GB of attorney-client privileged files from the Stanton ISD v. BTC litigation — legal strategy, discovery responses, and counsel communications.
organisation Buford-Thompson Company, LTD
: Buford-Thompson Company, LTD. Description:
organisation TB
The exposed dataset totals 1.707 TB and includes: 5 years of W-2 EFW2 files (2021–2025) containing plaintext Social Security numbers, wages, and addresses for 350+ current and former employees — every SSN readable without any decryption.
organisation Social Security
The exposed dataset totals 1.707 TB and includes: 5 years of W-2 EFW2 files (2021–2025) containing plaintext Social Security numbers, wages, and addresses for 350+ current and former employees — every SSN readable without any decryption.
organisation SSN
The exposed dataset totals 1.707 TB and includes: 5 years of W-2 EFW2 files (2021–2025) containing plaintext Social Security numbers, wages, and addresses for 350+ current and former employees — every SSN readable without any decryption.
data_breach 1.707 TB
The exposed dataset totals 1.707 TB and includes: 5 years of W-2 EFW2 files (2021–2025) containing plaintext Social Security numbers, wages, and addresses for 350+ current and former employees — every SSN readable without any decryption.
Tactical Metrics
Metrics
infrastructure
‎9.3
Software Version
9.3 GB of attorney-client privileged files from the Stanton ISD v. BTC litigation — legal strategy, discovery responses, and counsel communications.
Metrics
data_breach
9
Gb
9.3 GB of attorney-client privileged files from the Stanton ISD v. BTC litigation — legal strategy, discovery responses, and counsel communications.
Metrics
data_breach
2
Tb
The exposed dataset totals 1.707 TB and includes: 5 years of W-2 EFW2 files (2021–2025) containing plaintext Social Security numbers, wages, and addresses for 350+ current and former employees — every SSN readable without any decryption.
Intelligence Sources
Ransomware Live 2026-09-30