Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Thomas Y. Pickett & Co., Inc.

typco.com

Group Aurora
Discovered 2026-10-05 08:57 UTC
Est. attack date 2026-10-05
Country US
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

[consulting] Thomas Y. Pickett & Co., Inc. — founded in 1926, headquartered in Addison/Dallas, Texas — is one of the oldest property tax appraisal consulting firms in the United States. They appraise mineral, industrial, and utility properties for county appraisal districts across Texas, Wyoming, North Dakota, Mississippi, Oklahoma, and beyond. Roughly 40 employees, ~$5.3M annual revenue, nearly a century of reputation. Inventory: 13 SQL Server database backups (127 GB) including the 102 GB TYPortal web portal database containing all property owner records and user credentials Complete HR records for all 40+ employees — Social Security cards, W-4s, direct deposit forms, salary schedules, medical records, termination documents, TWC hearing notices 11 GB Azure DevOps repository — the entire source code history, including a 6,105-line proprietary COBOL program (NOTICE14) that generates tax appraisal notices 200+ client contracts with pricing for every county appraisal district they serve — the competitive intelligence gold mine Complete financial records — bank statements (PNC and Frost), 10-year budget, accounts receivable, payroll, and evidence of a prior fraud incident in May 2025 A developer's password exposed in a directory name visible to anyone who looks at the file listing A PKCS#12 digital signing certificate (private key) for an HR manager — enabling document forgery

Infostealer activity detected by HudsonRock

Compromised Employees: 0

Compromised Users: 4

Third Party Employee Credentials: 0


External Attack Surface: 1


Exposure Report
by ParanoidLab
114
Passwords
0 critical
0
Cookies
0 critical
Last queried 2026-10-05 09:46 UTC

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • No emails found.
MX Records
  • typco-com.mail.protection.outlook.com. Microsoft 365
TXT Records
  • MS=ms72784052
  • v=spf1 include:spf.protection.outlook.com -all
Cloud / SaaS Services Detected
Microsoft 365

Leak Screenshot:

Leak Screenshot