Was Diamond Truck Centres hit by ransomware?

Diamond Truck Centres was listed by the aurora ransomware operation (Canada), and stolen data was published on the group's leak site. Darkfield tracks this disclosure with the original leak post, screenshot and group context.

Who is the aurora ransomware group?

aurora is a ransomware operator tracked by Darkfield. See the full operator dossier for its known victims, sectors targeted, IOCs and leak-site infrastructure.

What data was leaked in the Diamond Truck Centres breach?

aurora published data attributed to Diamond Truck Centres. Darkfield captured the leak post and a screenshot of the listing.

Ransomware victim disclosure

← All victims

Diamond Truck Centres

Claimed by Aurora · listed 21 hours ago

Today

Age

since listed · data leaked

Status timeline

ListedJun 16, 2026
Data leakeddate unknown

At a glance

Group: Aurora
Status: Data leaked
Country: Canada
Sector: Transportation/Logistics
Listed on leak site: Jun 16, 2026

About the victim

AI dossier — public-source company profile

Diamond Truck Centres is Western Canada's largest International Trucks dealership group, operating 9 dealer and 13 sub-dealer locations across the region with approximately $63M in annual revenue and 250 employees. The company serves both commercial and government customers including municipal and military procurement.

Industry: Heavy Equipment & Truck Dealership
Employees: 250

Attack summary

Severity: critical — Confirmed exfiltration of highly regulated data at scale: employee PII (SINs, payroll, biometric), customer financial data (PAD forms, bank deposit records), military/ITAR-controlled goods documentation, immigration documents, and system credentials. Government customer data (City of Saskatoon, RCMP, CFB Edmonton) amplifies sensitivity. 17-year historical depth increases breach scope.

Aurora claims to have exfiltrated 17 years of complete operational data (2009–2026) from Diamond's shared drives, including employee payroll records, customer banking information, military contract documentation, biometric data, and system credentials. No encryption or operational disruption is mentioned; the group has published the data.

critical

Data the group says was taken

AI dossier — extracted from the leak post

53 customer Pre-Authorized Debit (PAD) forms with full banking details
17 years of employee payroll data including wages and SINs
ADP biometric fingerprint timeclock enrollment records
Immigration documents for 6+ foreign workers (LMIA, PNOC)
System credentials in plaintext (ADP, timeclock, safe access)
Military contract documentation (ITAR/CGP, MSVS, military vehicle data, CFB Edmonton, RCMP programs)
289 GB of daily bank deposit scans (2017–2026) with cheque images
Complete Outlook PST archive (166 MB) with internal email

What the group claims

[dealership, trucks] *** — Western Canada's largest International Trucks dealership group (9 dealer + 13 sub-dealer locations, ~$63M revenue, 250 employees). The dataset spans 17 years of unbroken operational history (2009–2026) and represents the full shared-drive contents of the entire company: HR, payroll, accounting, military contracts, and individual employee profiles. The exposed material includes: 53 customer Pre-Authorized Debit (PAD) forms — full bank account numbers, transit numbers, institution numbers, and authorized signatures for commercial customers including the City of Saskatoon. 17 years of employee payroll data — wages, SINs (implied), pension contributions, benefits, termination calculations for every employee since 2009. Biometric data — ADP fingerprint timeclock enrollment records for all locations. Immigration documents for 6+ foreign workers — LMIA applications, offers of employment, provincial nominee support docs. System credentials in plaintext — ADP timeclock passwords, manager training logins, safe combination. Military contract documentation — Diamond's Controlled Goods Security Plan (ITAR/CGP), MSVS delivery matrices, military vehicle VINs, CFB Edmonton and RCMP vehicle program data. 289 GB of daily bank deposit scans (2017–2026) — customer cheque images with names, amounts, and account details. A complete Outlook PST archive (166 MB) — years of internal email likely containing credentials and customer data.

Sources

Source

Indexed 21 hours ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.

Is this your supplier? Your competitor? You?

Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.

Disclosure context

About aurora

Aurora is a recently emerged ransomware group first observed in April 2026, operating with apparent financial motivations through targeted attacks across multiple sectors. Given its recent emergence, limited public documentation exists regarding the group's specific country of origin or affiliations with established ransomware operations, though its targeting patterns suggest a professional operation potentially operating as an independent entity rather than a known Ransomware-as-a-Service model. The group has demonstrated a preference for attacking business-critical sectors including business services, consumer services, manufacturing, healthcare, and financial services, with documented attacks spanning the United States, Canada, the Maldives, and Great Britain, though specific initial access vectors and technical methodologies remain undocumented by major threat intelligence firms. With only seven known victims documented since April 2026, Aurora represents a relatively small-scale operation compared to established ransomware families, though its cross-sector targeting approach and international victim scope indicate deliberate selection criteria rather than opportunistic attacks. The group remains active as of current reporting, though the limited victim count and recent emergence suggest either a highly selective targeting approach or a nascent operation still developing its operational capabilities. The group has been linked to 13 public disclosures across our corpus. First observed on a leak site on April 29, 2026; most recent post June 16, 2026. The operation is currently active.

Timeline of this disclosure

June 16, 2026Diamond Truck Centres listed by auroraon the group's public leak site

Other recent disclosures by aurora

aurora has been linked to 13 public victims on Darkfield. A sample of the most recent:

See the full aurora dossier →

Sector and geography

This disclosure adds to ransomware activity in the Transportation/Logistics sector, which has 1,080 disclosures indexed across all operators we track. Geographically, Diamond Truck Centres is reported in Canada, a country with 313 ransomware disclosures in our corpus.

If your organisation is affected

A listing by aurora means Diamond Truck Centres appeared on a ransomware extortion site and data attributed to it has been published. If this is your organisation, or a supplier you depend on, the priority is to confirm the intrusion and contain it before the window to act closes.

Engage your incident-response team and preserve forensic evidence before remediating — do not wipe affected systems first.
Force a password reset and revoke active sessions for exposed accounts; rotate any credentials, API keys or certificates that may have been in the stolen data.
Assess regulatory notification duties (GDPR, NIS2, sector regulators) — many carry a 72-hour reporting clock from awareness.
Report the incident to your national CERT, CCCS (Canada), as required for your jurisdiction.
Monitor for the data appearing on aurora's leak site and across paste and breach channels, and brief downstream partners who may be exposed through you.

How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.