Skip to content
Leak-site post naming GreenbergFarrow, captured by ThreatCluster

GreenbergFarrow

aurora

Ransomware leak-site victim intelligence · EN

Data size
72 GB
Files
6
Views
9,787
Posted
Oct 27, 2026
Country
United States
Industry
architecture

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot

Aurora claims to have stolen 283 GB from GreenbergFarrow’s Discipline Libraries, described as the complete architecture reference library, and published six files. The data categories claimed encompass personnel records, financial data, legal and regulatory documents, banking information, FBI clearance documents, and acquisition records. The victim is GreenbergFarrow, an ESOP-owned architecture firm headquartered in Atlanta; the leak page is published and shows a countdown of 12 days, 15 hours, 44 minutes, 46 seconds.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Employees
0
Domains
greenbergfarrow.com

What was taken

GreenbergFarrow — a respected ESOP-owned architecture firm headquartered in Atlanta, Georgia with offices in Charlotte, Dallas, Los Angeles, New York, Myrtle Beach, and international operations in Mexico, Colombia, India, and Canada.

Data categories
personal datafinancial informationlegal documentsinvoices and budgetslitigation documents
File types seen
pdf × 3xlsx × 3
Sample files (6)
Defendants Answers to Interrogatories.pdf
GF Complaint.pdf
DBI Employee Census.xlsx
SGA Employee Census.xlsx
Bachman & Associates W-9.PDF
Login Information.xlsx

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Data Publishing cadence
5 days: 11 hours: 40 min: 15 sec
The dataset spans three major divisions
Client Libraries (152 client folders, A–F): Proprietary architectural designs, prototypes, and specifications for major retail chains, banks, and restaurant brands including Circle K, Capital One, 7-Eleven, Chase Bank, Chipotle, Comcast, Bath & Body Works, and DSW. Corporate Library: The entire institutional memory — 24 years of accounting (invoicing, cleared checks, budgets from 2002–2026), administration (7 acquisitions, active litigation, ESOP governance, FBI clearance, employment agreements), and 72 GB of proprietary CAD standards. Discipline Libraries (283 GB): Complete architecture reference library.

Leak-site images (2)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
Logo featuring the letters "GF" in black, with a blue geometric shape in the background.
onion leak page8.4 KB