Diamond Truck Centres (Canada) reported a ransomware-related data breach impacting Western Canada’s largest International Trucks dealership group (CA), attributed to the aurora threat actor. The incident exposed extensive shared-drive data including HR and payroll records, biometric fingerprint timeclock enrollment data, immigration documents, plaintext system credentials, military contract/vehicle information, and customer bank deposit and PAD form details. #Canada
Incident Details
- Victim: Diamond Truck Centres
- Sector: Transportation/Logistics
- Country: CA
- Actor: aurora
- Source: http://u6lieui2dakbctcjea2bz4r4q32r7t36nwljovqbv7mxs6o2smgxixid.onion/blog/diamond-truck-centres-98cd07d1
- Discovered: 2026-06-16T13:21:27.187972+00:00
- Published: 2026-06-16T00:00:00+00:00
Information
- Western Canada’s largest International Trucks dealership group, with 9 dealer and 13 sub-dealer locations, about $63M in revenue, and 250 employees.
- 17 years of shared-drive records covering HR, payroll, accounting, military contracts, and individual employee profiles.
- 53 customer PAD forms containing full banking details and authorized signatures, including commercial customers such as the City of Saskatoon.
- Payroll records for every employee since 2009, including wages, SIN-related data, pension contributions, benefits, and termination calculations.
- Biometric enrollment records for all locations from the ADP fingerprint timeclock system.
- Immigration-related documents for more than 6 foreign workers, including LMIA applications, employment offers, and provincial nominee support materials.
- Plaintext system access details, including ADP timeclock passwords, manager training logins, and a safe combination.
- Military contract files, including the Controlled Goods Security Plan, MSVS delivery matrices, military vehicle VINs, and CFB Edmonton and RCMP vehicle program data.
- 289 GB of daily bank deposit scans from 2017 to 2026, including customer cheque images with names, amounts, and account details.
- A complete Outlook PST archive containing years of internal email likely including credentials and customer information.
Disclaimer: This post is based on public claims made by the ransomware group "aurora". I cannot confirm the accuracy of the information. However, I would be happy to share any official statement from the affected organization to provide clarification.