Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Natco Home Group

natcohome.com

Group Aurora
Discovered 2026-08-17 14:22 UTC
Est. attack date 2026-08-17
Country US
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

[manufacturer] Natco Home Group — a fourth-generation, family-owned home furnishings manufacturer headquartered in West Warwick, Rhode Island, with ~800 employees, ~$100M annual revenue, and facilities across seven US states. The exfiltrated dataset spans the company's entire corporate history and includes: Social Security numbers in plaintext for 100–120 legacy employees dating back to 1979 in an unencrypted PayUSA payroll database, plus 10 years of ADP payroll data (2017–2026) covering 700–1,000 current and former employees — pay stubs, W-2s, W-4s, 401k records, drug test results, background checks, and medical leave records. <censored> <censored> <censored> <censored> Years of divisional financial statements, income tax records, customer credit data for major retailers, 18 years of bad-debt reserve calculations, and acquisition-related materials.

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • domain.operationsweb.com
MX Records
  • mx1-us1.ppe-hosted.com. Proofpoint
  • mx2-us1.ppe-hosted.com. Proofpoint
TXT Records
  • apple-domain-verification=g3Wpl2a7e5nfkymq
  • knowbe4-site-verification=afd8aa54ea91f8f728acda2c9ca8d577
  • ppe-d057bae9ce9c07fcabd25f85935235807db49f46
  • MS=ms40893729
  • v=spf1 a:dispatch-us.ppe-hosted.com ip4:209.87.158.238 ip4:209.170.243.5/27 ip4:65.175.135.120 ip4:64.69.106.170/30 ip4:216.195.128.72/29 ip4:205.144.220.161/30 ip4:40.132.8.66/30 include:spf.protection.outlook.com include:_spf.psm.knowbe4.com ~all
  • dtm-domain-verification=Hd2P4ADdwtiNp7rQ0Zlxv8mNog02HiGyPqGEYjtP8fI
  • a4qoq8c306bs3ogf6rk1so2bp8
  • google-site-verification=6DKzS0UQvRiZNmxHZBJZGMhm0J6rDN18yjuztnf5vf8
  • 6dtfc97rtn1erkkiv6pce5m7i7
Cloud / SaaS Services Detected
Apple KnowBe4 Microsoft 365 Proofpoint Essentials

Leak Screenshot:

Leak Screenshot