GreenbergFarrow Data Breach

GreenbergFarrow, a US-based architecture and engineering firm providing design and planning services for retail and commercial clients, was listed on Aurora ransomware’s dark-web leak portal on October 27, 2026. The listing was identified through SOCRadar’s Dark Web Monitoring service. The disclosure marks Aurora’s continued targeting of US-based professional services firms, a segment that has featured prominently in the group’s recent leak activity. Aurora has claimed 18 victims in the past 60 days. Its most frequently targeted sectors during that period were Manufacturing, Professional Services, and Other, with the United States, Italy, and Switzerland serving as its primary geographies. Other recent Aurora professional-services listings include Thomas Y. Pickett & Co. in the United States and Rechtsanwaltskanzlei Dr. Bien in Germany. GreenbergFarrow’s listing is consistent with Aurora’s documented pattern of targeting US professional and design firms, matching both the group’s leading sector focus and its primary geographic concentration.

No domain was available from the listing metadata for GreenbergFarrow, leaving SOCRadar’s infostealer pipeline without a query target for this victim. Because no stealer-log query could be executed, the absence of results in this case does not confirm that the organization is unaffected. Stealer-log data is inherently incomplete and may not capture credentials under alternate corporate domains, personal email aliases, or feeds outside the queried dataset. The lack of a domain therefore limits the scope of this correlation, and any credential exposure linked to GreenbergFarrow may simply reside in sources that could not be checked. Several scenarios remain open despite the absent query target. Credentials may have surfaced in feeds outside this dataset, been used and rotated before indexing, or been harvested under personal email aliases or alternate corporate domains. For architecture and engineering firms such as GreenbergFarrow, Microsoft 365 access, project management platforms, and VPN gateways represent the primary attack surface. Should any GreenbergFarrow credentials exist in stealer-log feeds, exposure tied to these access points could offer attackers a potential route into corporate accounts and remote-access infrastructure, although no such correlation could be established in this case. The appropriate response centers on continued credential monitoring and proactive credential-hygiene checks. Given the limitations above, monitoring should extend to alternate corporate domains and personal email aliases where GreenbergFarrow credentials may have been harvested, as well as stealer-log feeds beyond the queried dataset. Reviews of Microsoft 365 access, project management platforms, and VPN gateway activity, which together constitute the primary attack surface for architecture and engineering firms, should accompany these checks so that exposed or reused credentials are identified and addressed promptly.