Diamond Truck Centres Listed by aurora Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 16, 2026, the aurora ransomware group listed Diamond Truck Centres on its leak site and claimed to hold internal files taken from the company. The number of individuals whose information may be involved remains unknown, and the organisation has not confirmed the claims. The incident centres on a ransomware operation in which files were removed from the dealership group’s systems. Public reporting states only that internal files were exfiltrated; no further details on the timing of the intrusion, the method of access, or the volume of data have been released.

What happened

The aurora group posted Diamond Truck Centres on its data-leak site on 16 June 2026. The listing asserts that files were taken during a ransomware attack. No independent confirmation of the theft or its scope has been made public, and the company has not issued a statement on the matter.

Inside aurora

Aurora is a ransomware operation that typically gains access to corporate networks, deploys encryption, and removes copies of files before demanding payment. The group maintains a leak site where it lists organisations it claims have not paid ransoms, publishing samples or descriptions of the material it says it holds. Such listings are presented by the group itself and remain unverified until confirmed by the affected organisation or by law-enforcement findings.

Who is Diamond Truck Centres?

Diamond Truck Centres operates as Western Canada’s largest International Trucks dealership group, with nine dealer locations and thirteen sub-dealer sites. The business employs roughly 250 people and reported revenue of approximately $63 million. Dealership groups of this scale routinely maintain records covering sales, service, parts, fleet contracts, and employee administration across multiple provinces.

What data was at risk

The listing describes the material as the full contents of the company’s shared drives, covering seventeen years of operations from 2009 to 2026. Named categories include human-resources files, payroll records, accounting documents, military contracts, and individual employee profiles. The only specific data type quantified in the available information is 53 customer Pre-Authorized Debit forms containing bank account numbers, transit numbers, institution numbers, and authorised signatures, including forms linked to the City of Saskatoon. All other details about the contents remain unconfirmed.

What's at stake

Individuals named in employee or customer records face the possibility that their personal or financial details could be used for fraud or identity theft if the material circulates further. Commercial customers whose banking authorisations appear in the disclosed forms may need to review account mandates and contact their financial institutions. For the organisation, the exposure of military contracts and long-term operational records could affect client relationships and regulatory obligations, though the precise impact depends on what, if any, data is later verified as having been taken.

Were you affected?

Anyone who has done business with Diamond Truck Centres or worked at the company should monitor bank and credit accounts for unusual activity and consider placing fraud alerts with credit-reporting agencies. A free exposure scan of an email address against known breach data sets can indicate whether the address has appeared in previously published collections; such scans do not confirm involvement in this specific incident. Organisations that receive services from the dealership may wish to contact their account representatives directly for any guidance the company chooses to provide.

AICompiled with AI assistance from public sources and published under our editorial standards.