Aurora ransomware activity targeted Allan Brothers Fruit, a third-generation U.S. tree-fruit operation in Naches, Washington, and threatened to disrupt operations by exfiltrating sensitive systems and employee data. Stolen information included ADP records, W-2 filings with Social Security Numbers, direct deposit details for ACH fraud, H-2A/I-9 employment documentation, Oracle RMAN production backups, badge photos, and OSHA incident logs, impacting the United States #UnitedStates
Incident Details
- Victim: Allan Brothers Fruit
- Sector: Agriculture and Food Production
- Country: US
- Actor: aurora
- Source: http://u6lieui2dakbctcjea2bz4r4q32r7t36nwljovqbv7mxs6o2smgxixid.onion/blog/allan-brothers-fruit-a383ba98
- Discovered: 2026-06-16T13:22:03.166497+00:00
- Published: 2026-06-16T00:00:00+00:00
Information
- Allan Brothers, Inc. is a third-generation, family-owned tree-fruit operation headquartered in Naches, Washington, packing and shipping apples and cherries from a 300,000 sq ft cold-storage facility with about 45 full-time staff and up to 2,000 seasonal workers during peak harvest.
- Eight server volumes were exposed.
- 14,228 employee records from ADP Workforce Now were taken, including names, dates of birth, phone numbers, gender, employment history, and photos for everyone who has ever worked there, including seasonal cherry pickers, H-2A visa workers, and office staff.
- W-2 tax filings with full Social Security Numbers were exposed for employees across eight legal entities: ALLAN, ABMEXICO, ABSAGE, ABSAGEMOOR, ABVINEYARD, ABAG, ABSHELTON, and ABFROST.
- Direct deposit forms containing bank routing numbers and account numbers for named individuals were taken, creating risk for ACH fraud.
- H-2A visa worker tracking spreadsheets and I-9 employment eligibility audits were exposed, revealing which workers have or are missing Social Security Numbers and exposing immigration status information.
- A complete Oracle RMAN database backup of the Famous Software production system was taken, including grower settlement, customer pricing, and lot-tracking data.
- 1.3 GB of employee badge photos was exposed, linking facial images to names and employee IDs for hundreds of workers.
- COBOL-era accounting databases spanning eight legal entities were taken, including GL, AP, AR, payroll, and W-2 filing data going back years.
- OSHA incident logs were exposed, naming workers who sustained injuries along with injury descriptions and treatment details.
Disclaimer: This post is based on public claims made by the ransomware group "aurora". I cannot confirm the accuracy of the information. However, I would be happy to share any official statement from the affected organization to provide clarification.