Allan Brothers Fruit Listed by aurora Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

What is known is that on June 16, 2026, the ransomware group aurora listed Allan Brothers Fruit on its leak site and stated that it had obtained internal files from the company. The number of people affected remains undisclosed by the organization, and no confirmation of the data’s authenticity or scope has been made public. For current and former employees whose records may be involved, the incident raises the possibility that personal details held by their employer have left the company’s control.

What happened

The incident came to light when aurora posted Allan Brothers Fruit on its data-leak site. The group claims to have exfiltrated internal files during a ransomware attack, though the company has not released an official statement detailing the intrusion or its response. No information has been provided on when the access occurred, how many files were taken, or whether any systems were encrypted.

Inside aurora

Aurora is a ransomware operation that follows the common pattern of encrypting victim systems and copying data before demanding payment. The group maintains a public leak site where it lists organizations it claims to have targeted, using the threat of disclosure to pressure victims. Such groups typically gain initial access through phishing, remote-desktop vulnerabilities, or compromised credentials, then move laterally inside networks to locate file servers and backup systems.

Who is Allan Brothers Fruit?

Allan Brothers, Inc. is a third-generation, family-owned tree-fruit business based in Naches, Washington. The company operates a 300,000-square-foot cold-storage facility where it packs and ships apples and cherries. It maintains a small core of roughly 45 full-time employees and scales to as many as 2,000 seasonal workers during harvest. Like other agricultural packers, it handles payroll, tax, and personnel records for a workforce that includes both year-round staff and temporary H-2A visa workers.

The information in question

The only details released so far come from aurora’s listing, which states that eight server volumes were accessed and that 14,228 employee records were taken from the ADP Workforce Now platform. Those records are described as containing names, dates of birth, phone numbers, gender, employment history, and photographs for every person who has worked at the company. The organization itself has not confirmed the contents or volume of any exfiltrated material, so the precise data types remain unverified.

Why it matters

Records that include dates of birth, government forms such as W-2 filings, and employment histories can be used for identity theft or to file fraudulent tax returns. Seasonal agricultural workers, many of whom move between employers and may have limited English proficiency, can face added difficulty monitoring their financial accounts or responding to misuse of their information. For the company, the exposure of operational files could reveal business practices or customer arrangements that competitors or regulators might examine.

If your data was in this claimed breach

Anyone who has worked at Allan Brothers Fruit should watch bank, tax, and benefits accounts for unusual activity and consider placing a credit freeze with the major bureaus. Contacting the company directly can clarify what steps, if any, it is taking to notify affected individuals. Readers can also run a free exposure scan of their email address against known breach data sets to see whether their information appears in other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.