Ransomware victim disclosure
← All victimsBaresque Group
Claimed by aurora · listed 21 days ago
Status timeline
- Listed
Apr 29, 2026
- Data leaked
At a glance
- Group
- aurora
- Status
- Data leaked
- Country
- GB
- Sector
- Consumer Services
- Listed on leak site
- Apr 29, 2026
About the victim
AI dossier — public-source company profileBaresque Group is a commercial-interiors company headquartered in Perth, Australia, with offices in Dallas, Chicago, and Brussels. The company designs and distributes architectural surface products including Zintra acoustic panels, FUNC furniture, botton+gardiner wallcoverings, and Scribblr surfaces. It operates across Australia, the United States, and Europe.
- Industry
- Commercial Interiors & Architectural Products
- Address
- Perth, Australia (HQ); offices in Dallas, TX, USA; Chicago, IL, USA; Brussels, Belgium
Attack summary
Severity: critical — The disclosed data includes regulated PII at scale (passports, birth certificates, driver's licences, TFN declarations for an entire multinational workforce), medical records (workers compensation files with diagnoses and treatment plans), privileged legal documents, full plaintext credential sets for all critical systems, and TLS private keys enabling domain impersonation — constituting a critical multi-category regulated data breach across multiple jurisdictions (Australia, US, EU).The Aurora ransomware group claims to have exfiltrated a broad range of sensitive data from Baresque Group, including employee identity documents, plaintext system credentials, TLS private keys, 343 GB of product R&D files, board and financial records, privileged legal documents, and workers compensation medical records. No encryption claim is explicitly stated; the post focuses entirely on data exfiltration and publication.
Data the group says was taken
AI dossier — extracted from the leak post- Passport scans (100+)
- Birth certificates (35)
- Driver's licences (60+)
- Tax File Number (TFN) declarations (50+)
- Plaintext credentials for Microsoft 365, Elmo Talent HR platform, LogMeIn, 3CX, Jim2 ERP
- Browser-exported credential CSVs
- Enterprise-wide Password_Listing.xls
- TLS private keys (4) for customer-facing domains
- SolidWorks CAD files and product blueprints (343 GB)
- Manufacturing specifications
- Board packs and financial reports
- Cash-flow models
- Active subpoena files
- Sworn affidavit exhibits
- Fair Work Australia tribunal filings
- Settlement agreements with confidentiality clauses
- Workers compensation medical records (diagnoses, treatment plans, claim amounts)
What the group claims
[design] Baresque Group — a respected commercial-interiors company headquartered in Perth, Australia, with offices in Dallas, Chicago, and Brussels. The exposed material includes: 100+ passport scans, 35 birth certificates, 60+ driver's licences, 50+ TFN declarations — the complete identity-theft toolkit for the entire workforce, spanning Australia, the US, and Europe. Plaintext credentials for every critical system — Microsoft 365, HR platform (Elmo Talent), remote-access gateway (LogMeIn), phone system (3CX), ERP (Jim2) — all in browser-export CSVs and an enterprise-wide Password_Listing.xls that had been sitting on a shared drive since at least 2017. 4 TLS private keys for customer-facing domains — enabling impersonation of the company's websites. 343 GB of product R&D — SolidWorks CAD files, manufacturing specifications, and product blueprints for Zintra acoustic panels, FUNC furniture, botton+gardiner wallcoverings, and Scribblr surfaces. The complete design library. Two years of board packs, financial reports, and cash-flow models — the company's entire strategic and financial position laid bare. Privileged legal documents — active subpoena files, sworn affidavit exhibits, Fair Work Australia tribunal filings, and settlement agreements with confidentiality clauses. Workers compensation medical records naming specific employees with diagnoses, treatment plans, and claim amounts.
Sources
Source
Indexed 21 days agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
