INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Aurora Publishes New Victim GreenbergFarrow

| 2026-10-27 12:11 CRITICAL HIGH RANSOMWARE & EXTORTION
JSON
Executive Summary
AI-generated
On October 27, 2026, the architecture firm GreenbergFarrow was targeted in a ransomware attack. The attackers are believed to be behind the Hydraq malware, which was used to exfiltrate sensitive data from the company's systems. This includes proprietary architectural designs and specifications for major retail chains, banks, and restaurant brands such as Circle K, Capital One, 7-Eleven, Chase Bank, Chipotle, Comcast, Bath & Body Works, and DSW. The attack also exposed personal data of over 300 individuals, including SSNs from three years of payroll tax returns, employee censuses with DOBs/salaries/home addresses, and an employee's complete termination package. The current status is unclear as the article does not provide further information on whether the attackers have demanded a ransom or if any payment has been made.
Technical Mitigations AI-generated
• Patch GreenbergFarrow's proprietary CAD standards to prevent exploitation of the architecture reference library. • Implement a robust access control mechanism for the entire attorney-client privilege chain, including complaint and discovery requests. • Monitor for suspicious activity related to the 7,450+ cleared check images with routing numbers, account numbers, payee details, and authorised signatures spanning 2014–2023.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
HydraqHydraq
Target & Sectors
NORTH_AMERICA NORTH_AMERICA financefinance retailretail hospitalityhospitality
Incident Timeline
‎2026/10/27
Aurora has published a new victim, GreenbergFarrow, exposing 300–650 individuals' personal data and proprietary architectural designs for major retail chains.
organisation ESOP
[architecture] GreenbergFarrow — a respected ESOP-owned architecture firm headquartered in Atlanta, Georgia with offices in Charlotte, Dallas, Los Angeles, New York, Myrtle Beach, and international operations in Mexico, Colombia, India, and Canada.
organisation Circle K
The dataset spans three major divisions: Client Libraries (152 client folders, A–F): Proprietary architectural designs, prototypes, and specifications for major retail chains, banks, and restaurant brands including Circle K, Capital One, 7-Eleven, Chase Bank, Chipotle, Comcast, Bath & Body Works, and DSW.
organisation Capital One
The dataset spans three major divisions: Client Libraries (152 client folders, A–F): Proprietary architectural designs, prototypes, and specifications for major retail chains, banks, and restaurant brands including Circle K, Capital One, 7-Eleven, Chase Bank, Chipotle, Comcast, Bath & Body Works, and DSW.
organisation Chase Bank
The dataset spans three major divisions: Client Libraries (152 client folders, A–F): Proprietary architectural designs, prototypes, and specifications for major retail chains, banks, and restaurant brands including Circle K, Capital One, 7-Eleven, Chase Bank, Chipotle, Comcast, Bath & Body Works, and DSW.
organisation Bath & Body Works
The dataset spans three major divisions: Client Libraries (152 client folders, A–F): Proprietary architectural designs, prototypes, and specifications for major retail chains, banks, and restaurant brands including Circle K, Capital One, 7-Eleven, Chase Bank, Chipotle, Comcast, Bath & Body Works, and DSW.
organisation DSW
The dataset spans three major divisions: Client Libraries (152 client folders, A–F): Proprietary architectural designs, prototypes, and specifications for major retail chains, banks, and restaurant brands including Circle K, Capital One, 7-Eleven, Chase Bank, Chipotle, Comcast, Bath & Body Works, and DSW.
victims 152 client folders
The dataset spans three major divisions: Client Libraries (152 client folders, A–F): Proprietary architectural designs, prototypes, and specifications for major retail chains, banks, and restaurant brands including Circle K, Capital One, 7-Eleven, Chase Bank, Chipotle, Comcast, Bath & Body Works, and DSW.
organisation CAD
Corporate Library: The entire institutional memory — 24 years of accounting (invoicing, cleared checks, budgets from 2002–2026), administration (7 acquisitions, active litigation, ESOP governance, FBI clearance, employment agreements), and 72 GB of proprietary CAD standards.
data_breach 72 GB
Corporate Library: The entire institutional memory — 24 years of accounting (invoicing, cleared checks, budgets from 2002–2026), administration (7 acquisitions, active litigation, ESOP governance, FBI clearance, employment agreements), and 72 GB of proprietary CAD standards.
organisation SF 328
FBI facility clearance documents — SF 328 (Certificate Pertaining to Foreign Interests), DD 441 (Facility Clearance), Key Management Personnel lists, and SCIF project architectural drawings acquired through DBI Architects.
organisation Certificate Pertaining to Foreign Interests
FBI facility clearance documents — SF 328 (Certificate Pertaining to Foreign Interests), DD 441 (Facility Clearance), Key Management Personnel lists, and SCIF project architectural drawings acquired through DBI Architects.
organisation Key Management Personnel
FBI facility clearance documents — SF 328 (Certificate Pertaining to Foreign Interests), DD 441 (Facility Clearance), Key Management Personnel lists, and SCIF project architectural drawings acquired through DBI Architects.
organisation DBI Architects
FBI facility clearance documents — SF 328 (Certificate Pertaining to Foreign Interests), DD 441 (Facility Clearance), Key Management Personnel lists, and SCIF project architectural drawings acquired through DBI Architects.
organisation Discipline Libraries
Discipline Libraries (283 GB): Complete architecture reference library.
data_breach 283 GB
Discipline Libraries (283 GB): Complete architecture reference library.
organisation Medicare
The exposed material includes: 300–650+ individuals' personal data — SSNs from three years of payroll tax returns, 57+ W-9 forms, employee censuses with DOBs/salaries/home addresses, and an employee's complete termination package including Medicare enrollment and voicemail recording.
Tactical Metrics
Metrics
victims
152
Client Folders
The dataset spans three major divisions: Client Libraries (152 client folders, A–F): Proprietary architectural designs, prototypes, and specifications for major retail chains, banks, and restaurant brands including Circle K, Capital One, 7-Eleven, Chase Bank, Chipotle, Comcast, Bath & Body Works, and DSW.
Metrics
data_breach
72
Gb
Corporate Library: The entire institutional memory — 24 years of accounting (invoicing, cleared checks, budgets from 2002–2026), administration (7 acquisitions, active litigation, ESOP governance, FBI clearance, employment agreements), and 72 GB of proprietary CAD standards.
Metrics
data_breach
283
Gb
Discipline Libraries (283 GB): Complete architecture reference library.
Intelligence Sources
Ransomware Live 2026-10-27