Skip to main content
Darkfield

Ransomware victim disclosure

← All victims

Allan Brothers Fruit

Claimed by Aurora · listed 21 hours ago

Today
Age
since listed · data leaked

Status timeline

  1. ListedJun 16, 2026
  2. Data leakeddate unknown

At a glance

Group
Aurora
Status
Data leaked
Country
United States
Sector
Agriculture and Food Production
Listed on leak site
Jun 16, 2026

About the victim

AI dossier — public-source company profile

Allan Brothers, Inc. is a third-generation, family-owned tree-fruit operation headquartered in Naches, Washington. The company packs and ships apples and cherries from a 300,000 sq ft cold-storage facility, employing approximately 45 full-time staff and up to 2,000 seasonal workers during peak harvest.

Industry
Agriculture and Food Production — Tree Fruit Packing & Distribution
Address
Naches, Washington, US
Employees
45-2000

Attack summary

Severity: critical — Confirmed exfiltration of PII at scale (14,228+ individuals), regulated financial data (tax SSNs, banking details), immigration documents exposing vulnerable H-2A visa workers, health/injury records, and complete operational databases. Multiple categories of highly sensitive data affecting employees, contractors, and business operations.

Aurora claims to have exfiltrated eight server volumes containing comprehensive employee records, financial data, tax filings, banking information, immigration documents, and operational databases. The group published the data without stated ransom demand.

critical

Data the group says was taken

AI dossier — extracted from the leak post
  • 14,228 employee records (names, DOB, phone, gender, employment history, photos)
  • W-2 tax filings with full Social Security Numbers
  • Direct deposit forms with bank routing and account numbers
  • H-2A visa worker tracking and I-9 employment eligibility documents
  • Oracle RMAN database backup (grower settlement, customer pricing, lot tracking)
  • 1.3 GB employee badge photos with facial images
  • COBOL accounting databases (GL, AP, AR, payroll, W-2 data across 8 entities)
  • OSHA incident logs with worker injury details

What the group claims

[food] Allan Brothers, Inc. — a third-generation, family-owned tree-fruit operation headquartered in Naches, Washington. Allan Brothers packs and ships apples and cherries from a 300,000 sq ft cold-storage facility, employing roughly 45 full-time staff and up to 2,000 seasonal workers during peak harvest. Eight server volumes: 14,228 employee records from ADP Workforce Now — names, dates of birth, phone numbers, gender, employment history, photos — covering every person who has ever worked at Allan Brothers, including seasonal cherry pickers, H-2A visa workers, and office staff. W-2 tax filings with full Social Security Numbers for employees across eight legal entities (ALLAN, ABMEXICO, ABSAGE, ABSAGEMOOR, ABVINEYARD, ABAG, ABSHELTON, ABFROST). Direct deposit forms with bank routing numbers and account numbers for named individuals — the raw ingredients for ACH fraud. H-2A visa worker tracking spreadsheets listing which workers have or are missing Social Security Numbers, plus I-9 employment eligibility audits — exposing immigration status for the most vulnerable members of the workforce. A complete Oracle RMAN database backup of the Famous Software production system — the company's grower settlement, customer pricing, and lot-tracking engine. 1.3 GB of employee badge photos — facial images linked to names and employee IDs for hundreds of workers. COBOL-era accounting databases spanning 8 legal entities — GL, AP, AR, payroll, and W-2 filing data going back years. OSHA incident logs naming workers who sustained injuries, with injury descriptions and treatment details.

Sources

Source

Indexed 21 hours ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.

Is this your supplier? Your competitor? You?

Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.

Disclosure context

About aurora

Aurora is a recently emerged ransomware group first observed in April 2026, operating with apparent financial motivations through targeted attacks across multiple sectors. Given its recent emergence, limited public documentation exists regarding the group's specific country of origin or affiliations with established ransomware operations, though its targeting patterns suggest a professional operation potentially operating as an independent entity rather than a known Ransomware-as-a-Service model. The group has demonstrated a preference for attacking business-critical sectors including business services, consumer services, manufacturing, healthcare, and financial services, with documented attacks spanning the United States, Canada, the Maldives, and Great Britain, though specific initial access vectors and technical methodologies remain undocumented by major threat intelligence firms. With only seven known victims documented since April 2026, Aurora represents a relatively small-scale operation compared to established ransomware families, though its cross-sector targeting approach and international victim scope indicate deliberate selection criteria rather than opportunistic attacks. The group remains active as of current reporting, though the limited victim count and recent emergence suggest either a highly selective targeting approach or a nascent operation still developing its operational capabilities. The group has been linked to 13 public disclosures across our corpus. First observed on a leak site on April 29, 2026; most recent post June 16, 2026. The operation is currently active.

Timeline of this disclosure

  • June 16, 2026Allan Brothers Fruit listed by auroraon the group's public leak site

Other recent disclosures by aurora

aurora has been linked to 13 public victims on Darkfield. A sample of the most recent:

See the full aurora dossier →

Sector and geography

This disclosure adds to ransomware activity in the Agriculture and Food Production sector, which has 770 disclosures indexed across all operators we track. Geographically, Allan Brothers Fruit is reported in United States, a country with 3,101 ransomware disclosures in our corpus.

If your organisation is affected

A listing by aurora means Allan Brothers Fruit appeared on a ransomware extortion site and data attributed to it has been published. If this is your organisation, or a supplier you depend on, the priority is to confirm the intrusion and contain it before the window to act closes.

  • Engage your incident-response team and preserve forensic evidence before remediating — do not wipe affected systems first.
  • Force a password reset and revoke active sessions for exposed accounts; rotate any credentials, API keys or certificates that may have been in the stolen data.
  • Assess regulatory notification duties (GDPR, NIS2, sector regulators) — many carry a 72-hour reporting clock from awareness.
  • Report the incident to your national CERT, CISA (United States), as required for your jurisdiction.
  • Monitor for the data appearing on aurora's leak site and across paste and breach channels, and brief downstream partners who may be exposed through you.

How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.