Skip to content
Leak-site post naming Natco Home Group, captured by ThreatCluster

Natco Home Group

aurora

Ransomware leak-site victim intelligence · EN

Data size
1.707 TB
Views
58,524
Posted
Aug 17, 2026
Country
United States
Industry
manufacturing

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot

Aurora states that Natco Home Group exfiltrated a dataset spanning the company’s corporate history, including plaintext Social Security numbers for about 100–120 legacy employees dating back to 1979 and 10 years of ADP payroll data (2017–2026) covering roughly 700–1,000 current and former employees, with payroll records such as pay stubs, W-2s, W-4s, and 401(k) details. The data allegedly includes HR and recruitment records, executive email archives, HR investigation files, EEOC documentation, employee disciplinary records, and customer/retailer portal credentials (ALL PASSWORDS.xlsx). It also comprises security configuration data, including 15 SonicWall firewall exports across Natco facilities (admin passwords, VPN pre-shared keys, NAT rules, and ACLs) and HP/H3C switch configuration. The leak page lists Natco Home Group as the victim and shows the publication status as listed, with server links provided to the data.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Employees
0
Domains
natcohome.com
Platforms
SonicWall HP/H3C Dell iDRAC SQL Server

What was taken

Natco Home Group — a fourth-generation, family-owned home furnishings manufacturer headquartered in West Warwick, Rhode Island, with ~800 employees, ~$100M annual revenue, and facilities across seven US states. The exfiltrated dataset spans the company's entire corporate history and includes: Social Security numbers in plaintext for 100–120 legacy employees dating back to 1979 in an unencrypted PayUSA payroll database, plus 10 years of ADP payroll data (2017–2026) covering 700–1,000 current and former employees — pay stubs, W-2s, W-4s, 401k records, drug test results, background checks, and medical leave records. 15 SonicWall firewall configuration exports covering every Natco facility across Rhode Island, Maine, Georgia, California, New York, Massachusetts, and Illinois — including admin passwords, VPN pre-shared keys, NAT rules, and ACLs. Combined with an HP/H3C switch configuration and a 149 MB Dell iDRAC server-management dump, this is a complete network security blueprint. A spreadsheet called "ALL PASSWORDS.xlsx" — every customer and carrier portal credential (Walmart, Costco, Home Depot, FedEx, and more) in a single file on a shared drive. Hardcoded SQL Server SA password in application source code — the database superuser credential baked into a production application's config file and compiled binary, requiring a code change to rotate. 35+ GB of executive email archives (Outlook PST files), HR investigation files, EEOC documentation, and employee disciplinary records. Years of divisional financial statements, income tax records, customer credit data for major retailers, 18 years of bad-debt reserve calculations, and acquisition-related materials.

Data categories
Social Security numbersPayroll data (paystubs, W-2s, W-4s, 401k, drug tests, background checks, medical leave records)Customer and carrier credentials (ALL PASSWORDS.xlsx)Network configuration data and credentials (firewall exports, admin passwords, VPN pre-shared keys, NAT rules, ACLs, swiHardcoded database credentials (SQL Server SA password)Executive emails (PST files)HR investigation filesEEOC documentationEmployee disciplinary recordsDivisional financial statementsIncome tax recordsCustomer credit dataBad-debt reserve calculationsAcquisition-related materials
Leak site tags
manufacturer
File types seen
xlsx × 1
Sample files (1)
ALL PASSWORDS.xlsx

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Social
Instagram: https://www.instagram.com/natcohome/; Facebook: https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2FNatcoHomeGroup%2F; LinkedIn: https://www.linkedin.com/company/natco-home-products; YouTube: https://www.youtube.com/channel/UCbU29EOYWZH-d1LA-Yn-0CA
Server Links
["http://fofss3tzlhqgr3zpitf4ucbjlyj6ia6czuyjxqweo6o5c7iwwd5vdoad.onion/data/NATCOHOME", "https://sapurnale.io/data/NATCOHOME"]
Server links
http://fofss3tzlhqgr3zpitf4ucbjlyj6ia6czuyjxqweo6o5c7iwwd5vdoad.onion/data/NATCOHOME; https://sapurnale.io/data/NATCOHOME
Server Link 1
http://fofss3tzlhqgr3zpitf4ucbjlyj6ia6czuyjxqweo6o5c7iwwd5vdoad.onion/data/NATCOHOME
Server Link 2
https://sapurnale.io/data/NATCOHOME
Files — NATCOHOME
Server Link 1 http://fofss3tzlhqgr3zpitf4ucbjlyj6ia6czuyjxqweo6o5c7iwwd5vdoad.onion/data/NATCOHOME; Server Link 2 https://sapurnale.io/data/NATCOHOME

Leak-site images (2)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
Logo featuring the text "NATCO HOME" with a geometric design of squares in varying shades of blue.
onion leak page6.9 KB