Thomas Y. Pickett & Co., Inc. hit by aurora ransomware

Thomas Y. Pickett & Co., Inc. is one of the oldest property tax appraisal consulting firms in the United States. Founded in 1926, the company is headquartered in Addison and Dallas, Texas. It provides appraisal services for mineral, industrial, and utility properties to county appraisal districts across Texas, Wyoming, North Dakota, Mississippi, Oklahoma, and other regions. The firm employs roughly 40 people and reports annual revenue of approximately $5.3 million.

The incident was listed on ransomlook.io under the identifier for Thomas Y. Pickett & Co., Inc. The source indicates that the group aurora has claimed responsibility for the attack. The listing details specific data types allegedly exfiltrated during the breach.

Among the inventory described by the source is a directory of 13 SQL Server database backups totaling 127 GB. This includes the TYPortal web portal database, which contains all property owner records and user credentials. The firm’s complete HR records for all 40+ employees are also listed, encompassing Social Security cards, W-4 forms, direct deposit documents, salary schedules, medical records, and termination files.

The source further notes access to an 11 GB Azure DevOps repository containing the company's entire source code history. This includes a proprietary COBOL program used to generate tax appraisal notices. The breach reportedly exposed 200+ client contracts with pricing details for every county appraisal district served by the firm, alongside complete financial records including bank statements and prior fraud incident evidence.

Technical details cited in the source include a developer's password found in a visible directory name and a PKCS#12 digital signing certificate for an HR manager. These items are described as enabling potential document forgery and unauthorized access to sensitive administrative functions within the firm's infrastructure.