Summary
Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshotAurora states they have exfiltrated 127 GB of backups from Thomas Y. Pickett & Co., Inc., including 102 GB from the TYPortal web portal database, and have published five files. They claim the stolen data includes HR records, financial records, client contracts with pricing, source code history, property owner records, user credentials, passwords/credentials, and digital signing certificates/private keys. The leak page identifies the victim as Thomas Y. Pickett & Co., Inc., a Texas-based property tax appraisal consulting firm, notes a developer's password exposed in a publicly visible directory name, and shows a publication countdown of 6 days, 7 hours, 37 minutes, and 3 seconds.
Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.
Victim profile
- Employees
- 0
- Founded
- 1926
- Domains
- typco.com
- Platforms
- SQL Server Azure DevOps TYPortal web portal COBOL
What was taken
Thomas Y. Pickett & Co., Inc. — founded in 1926, headquartered in Addison/Dallas, Texas — is one of the oldest property tax appraisal consulting firms in the United States. They appraise mineral, industrial, and utility properties for county appraisal districts across Texas, Wyoming, North Dakota, Mississippi, Oklahoma, and beyond.
Also stated on the leak page
Fields this group publishes that do not map to a standard column. Labels are the site's own.
- Server Links
- ["http://bxd5wnvfssoxzzzedu3gvpghzdcnwq7bzqg2ysekhwm5u3o4orfovjad.onion/data/TYPDAL", "https://aur0rablog.io/data/TYPDAL"]
- inventory_summary
- 13 SQL Server database backups (127 GB) including the 102 GB TYPortal web portal database containing all property owner records and user credentials; 11 GB Azure DevOps repository — the entire source code history, including a 6,105-line proprietary COBOL program (NOTICE14) that generates tax appraisal notices; 200+ client contracts with pricing for every county appraisal district they serve — the competitive intelligence gold mine; Complete financial records — bank statements (PNC and Frost), 10-year budget, accounts receivable, payroll, and evidence of a prior fraud incident in May 2025; A developer's password exposed in a directory name visible to anyone who looks at the file listing; A PKCS#12 digital signing certificate (private key) for an HR manager — enabling document forgery.
- A developer's password exposed in a directory name visible to anyone who looks a
- present
Leak-site images (2)
Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.