Aurora ransomware group lists Bretford Manufacturing

Ransomware group Aurora claims to have exfiltrated extensive employee, financial, and engineering data from charging-solutions maker Bretford Manufacturing.

Bretford Manufacturing, a small Illinois-based manufacturer of mobile device charging solutions, has been listed as a victim on a ransomware leak site tracked under the identifier "aurora". The claimed exposure is unusually broad for a company of its size (~60 employees, ~$10M revenue), spanning 20 years of HR and payroll records, Social Security numbers for current and hundreds of historical employees and dependents, and corporate and vendor banking details drawn from NACHA ACH batch files covering 26+ vendor accounts.

Beyond financial and PII exposure, the disclosure reportedly includes sensitive internal IT infrastructure data — VPN gateway IPs, network topology diagrams, IP allocation tables, Active Directory domain information, and a disaster recovery plan — which could materially aid follow-on intrusion attempts against the company. The listing also references theft of proprietary engineering data, including SolidWorks CAD files and CNC/laser manufacturing programs, indicating potential intellectual property loss alongside the personal and financial data exposure.

No technical indicators, exploited vulnerabilities, or specific attack techniques are detailed in the source material, and the report is a leak-site victim listing rather than a full incident analysis. Given the victim's small size and lack of evidence of broader campaign activity or wide-scale exploitation, this is assessed as a routine ransomware/data-extortion disclosure rather than an exceptional event, though the depth of exposed personal and financial data represents a serious impact for the affected organization and its employees.

Source reporting: https://www.ransomware.live/id/QnJldGZvcmQgTWFudWZhY3R1cmluZ0BhdXJvcmE=