Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

The Buckner Company, Inc.

The Buckner Company, Inc.

Group Aurora
Discovered 2026-10-13 07:27 UTC
Est. attack date 2026-10-13
Country US
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

[insurance] The Buckner Company, Inc. is a commercial property & casualty insurance brokerage headquartered in Salt Lake City, Utah, with a second office in Denver, Colorado. The exfiltrated dataset includes: 1,500+ plaintext credentials — Chrome, Edge, and Google password exports from 8+ employees, plus 20+ password spreadsheets. Verified: kbennett’s file alone contains 503 entries covering Hartford, Travelers, Chubb, Progressive, Sedgwick, mortgage portals, banking, and personal accounts. Employee SSNs for 150–250 individuals — W-2 reports across three entities (TBC, TBI, COL) spanning four tax years (2019–2022), plus 2023 W-2 and 1099-NEC reports. 316 individual Total Compensation PDFs and 3+ years of Paycom payroll rate history — every employee’s salary, bonus, and benefits laid bare. A complete M&A acquisition pipeline — 60+ prospect folders with due diligence, LOIs, valuations, and the full BroadStreet Partners closing package (52 exhibits including Disclosure Schedules, MIPA, corporate structure documents). 128 Outlook PST email archives spanning years of business correspondence. Corporate tax returns for Buckner (2004–2024), Citrus Insurance LLC (2021–2023), and Consolidated Agencies (2022–2023). 7 named individuals’ driver license scans and the Applied Epic insurance management database (Epic.mdf).


Leak Screenshot:

Leak Screenshot