Skip to content
Leak-site post naming Bretford Manufacturing, captured by ThreatCluster

Bretford Manufacturing

aurora

Ransomware leak-site victim intelligence · EN

Files
7
Views
68,487
Posted
Jul 29, 2026
Country
United States
Industry
manufacturing

Summary

Written by ThreatClusterfrom file listing, victim profile, leak post, screenshot

The leak states that 7 files were taken from Bretford Manufacturing, Inc., including HR records, Social Security Numbers, financial data, CAD/engineering data, network architecture, disaster recovery plans/IT documentation, and payroll records. The leak page identifies Bretford Manufacturing, Inc. as the victim—a privately held charging-device manufacturer based in Franklin Park, Illinois, with about 60 employees and roughly $10 million in annual revenue; platforms named include KeePass, AWS IAM, Active Directory, SolidWorks CAD, VPN, and NACHA ACH. The leak post is published on the group’s leak site, and sample filenames published include AWS Restores.txt, AddVPN.ps1, POSPAY.TXT, ACHTRANSFER.TXT, fsansona credentials.csv, CreateNewUser.ps1, and credentials.csv.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Employees
60
Founded
1948
Domains
https://www.bretford.com/
Platforms
KeePass AWS IAM SolidWorks CAD Active Directory NACHA ACH

What was taken

Bretford Manufacturing, Inc. is a privately held manufacturer of charging solutions for mobile devices, founded in 1948 and headquartered in Franklin Park, Illinois. With ~60 employees and ~$10M annual revenue, it serves education, healthcare, retail, and government sectors.

Data categories
HR recordsSocial Security Numbers (SSNs)Bank account information (corporate and vendor)Product engineering data (SolidWorks CAD files, CNC/laser programs, manufacturing process documentation)Payroll and benefits data (1099 forms, payroll records, pension, 401(k), insurance enrollment, termination records)Security credentials and access data (KeePass vault, AWS IAM keys, plaintext local admin password, passwords spreadsheetNetwork and infrastructure documentation (VPN gateway IP, topology diagrams, IP allocation tables, disaster recovery pla
File types seen
csv × 2ps1 × 2txt × 3
Sample files (7)
AWS Restores.txt
AddVPN.ps1
POSPAY.TXT
ACHTRANSFER.TXT
fsansona credentials.csv
CreateNewUser.ps1
credentials.csv

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Phone
+1 800-521-9614
Address
11000 Seymour Avenue Franklin Park, IL 60131
Server Link 1
http://klzerfz7xsc7wp3nyik3adffspkkg4lmkeycarsjequnftby4aqsy6qd.onion/data/BRETFORDHQ
Server Link 2
https://rezervato.io/data/BRETFORDHQ

Leak-site images (2)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
Logo featuring a stylized number "8" in white on an orange background.
onion leak page7.5 KB