Franklin Empire Data Breach

The ransomware group aurora has claimed to target Franklin Empire, a US-based distributor of electrical supplies and industrial components. The listing occurred on October 5, 2026, with the threat actor threatening data release and claiming unauthorized access. SOCRadar’s Cyber Threat Intelligence (CTI) found 25 workstation compromise records associated with the domain franklinempire[.]com, all dated between September and October 2026. This type of activity often suggests that the targeted company possesses assets or operates in sectors that are attractive to ransomware actors, such as critical infrastructure or supply chain components, making them a potential target for disruptive attacks or data exfiltration. In the 60 days leading up to this report, aurora has claimed 16 victims. The group primarily targets the professional services, manufacturing, and retail industries, with notable victim countries including the United States, Germany, and Denmark. Recent victims attributed to aurora include Infomedia A/S, Thomas Y. Pickett & Co., Inc., and Laboratorios Roemmers SAICF. The targeting of Franklin Empire aligns with aurora’s typical industry focus on retail and manufacturing, and its geographic focus on the United States.

SOCRadar’s investigation identified 25 stealer log artifacts specifically related to endpoint compromises affecting Franklin Empire. These records exclusively point to workstation-level infections, with no evidence of other data types like network or server compromises within the observed telemetry. The timeframe for these detected compromises spans September to October 2026, indicating a concentrated period of malicious activity targeting employee workstations. This pattern of exclusively endpoint compromises is consistent with the deployment of infostealer malware. Such malware is designed to harvest sensitive information from infected machines, including browser-saved passwords, active session cookies, and other cached credentials. These stolen credentials can then be utilized by threat actors for unauthorized access and lateral movement within the victim’s network, potentially paving the way for ransomware deployment or further data exfiltration. The volume of 25 endpoint compromises within a single month suggests a significant pre-attack footprint. Given the presence of infostealer artifacts, all credentials accessed or stored on the affected workstations should be considered compromised. It is critical for Franklin Empire to conduct a full forensic sweep of all affected endpoints and to revoke all credentials associated with them. Active threat hunting across the enterprise is also recommended to identify any further signs of compromise or lateral movement. Organizations should not assume containment until thorough forensic analysis confirms the full scope of the incident.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.