Natco Home Group
● Listed in the last 48hAbout the organisation
[manufacturer] Natco Home Group — a fourth-generation, family-owned home furnishings manufacturer headquartered in West Warwick, Rhode Island, with ~800 employees, ~$100M annual revenue, and facilities across seven US states. The exfiltrated dataset spans the company's entire corporate history and includes: Social Security numbers in plaintext for 100–120 legacy employees dating back to 1979 in an unencrypted PayUSA payroll database, plus 10 years of ADP payroll data (2017–2026) covering 700–1,000 current and former employees — pay stubs, W-2s, W-4s, 401k records, drug test results, background checks, and medical leave records. Years of divisional financial statements, income tax records, customer credit data for major retailers, 18 years of bad-debt reserve calculations, and acquisition-related materials.
What the listing means
Natco Home Group appeared on the aurora leak site on 17 August 2026. Groups publish a victim once negotiations stall or as pressure during them, so a listing usually means data was already exfiltrated. This group has published 10 claims in the last 30 days and remains active.
Recommended actions
- Treat any unsolicited message referencing Natco Home Group as suspicious — leaked data gets weaponised for phishing within days.
- If you hold an account on Natco Home Group, change that password now, update it anywhere you reused it, and enable two-factor authentication.
- Other Retail & E-Commerce organisations should review this group's known TTPs and validate detection coverage against them.
- Watch for follow-on extortion: stolen data is often re-leaked or resold after the initial listing.
- A leak-site listing is a claim made by the attacker, not a confirmed breach — check the organisation's own disclosures before acting on it.
Leak-site evidence
Listing URL https://www.ransomware.live/id/TmF0Y28gSG9tZSBHcm91cEBhdXJvcmE=
Show leak-site screenshot
Captured from the group's extortion site. It may contain the victim's data or the attacker's messaging.
