Ransom! Thomas Y. Pickett & Co., Inc. (OCT-2026)

Information

• Founded in 1926 and headquartered in Addison/Dallas, Texas, the firm is one of the oldest property tax appraisal consulting companies in the United States.
• It appraises mineral, industrial, and utility properties for county appraisal districts across Texas, Wyoming, North Dakota, Mississippi, Oklahoma, and other states.
• The company has roughly 40 employees, annual revenue of about $5.3 million, and nearly a century of reputation.
• 13 SQL Server database backups totaling 127 GB were exposed, including the 102 GB TYPortal web portal database with property owner records and user credentials.
• Complete HR records for all 40+ employees were included, such as Social Security cards, W-4s, direct deposit forms, salary schedules, medical records, termination documents, and TWC hearing notices.
• An 11 GB Azure DevOps repository was accessed, containing the full source code history, including a 6,105-line proprietary COBOL program used to generate tax appraisal notices.
• More than 200 client contracts with pricing details for every county appraisal district served were exposed.
• Complete financial records were taken, including bank statements, a 10-year budget, accounts receivable, payroll information, and evidence of a prior fraud incident in May 2025.
• A developer password was exposed through a directory name visible in the file listing.
• A PKCS#12 digital signing certificate with a private key for an HR manager was also exposed, creating risk of document forgery.