Diamond Truck Centres
About the organisation
[dealership, trucks] *** — Western Canada's largest International Trucks dealership group (9 dealer + 13 sub-dealer locations, ~$63M revenue, 250 employees). The dataset spans 17 years of unbroken operational history (2009–2026) and represents the full shared-drive contents of the entire company: HR, payroll, accounting, military contracts, and individual employee profiles. The exposed material includes: 53 customer Pre-Authorized Debit (PAD) forms — full bank account numbers, transit numbers, institution numbers, and authorized signatures for commercial customers including the City of Saskatoon. 17 years of employee payroll data — wages, SINs (implied), pension contributions, benefits, termination calculations for every employee since 2009. Biometric data — ADP fingerprint timeclock enrollment records for all locations. Immigration documents for 6+ foreign workers — LMIA applications, offers of employment, provincial nominee support docs. System credentials in plaintext — ADP timeclock passwords, manager training logins, safe combination. Military contract documentation — Diamond's Controlled Goods Security Plan (ITAR/CGP), MSVS delivery matrices, military vehicle VINs, CFB Edmonton and RCMP vehicle program data. 289 GB of daily bank deposit scans (2017–2026) — customer cheque images with names, amounts, and account details. A complete Outlook PST archive (166 MB) — years of internal email likely containing credentials and customer data.
What the listing means
Diamond Truck Centres appeared on the aurora leak site on 16 June 2026. Groups publish a victim once negotiations stall or as pressure during them, so a listing usually means data was already exfiltrated. This group has published 1 claim in the last 30 days and remains active.
Recommended actions
- Treat any unsolicited message referencing Diamond Truck Centres as suspicious — leaked data gets weaponised for phishing within days.
- If you hold an account on Diamond Truck Centres, change that password now, update it anywhere you reused it, and enable two-factor authentication.
- Other Transportation/Logistics organisations should review this group's known TTPs and validate detection coverage against them.
- Watch for follow-on extortion: stolen data is often re-leaked or resold after the initial listing.
- A leak-site listing is a claim made by the attacker, not a confirmed breach — check the organisation's own disclosures before acting on it.
Leak-site evidence
Listing URL https://www.ransomware.live/id/RGlhbW9uZCBUcnVjayBDZW50cmVzQGF1cm9yYQ==
Show leak-site screenshot
Captured from the group's extortion site. It may contain the victim's data or the attacker's messaging.
