Baresque Group Listed by Aurora Ransomware Group

On April 22, 2026, the Aurora ransomware group added Baresque Group to its leak site, exposing internal files from the Australian commercial-interiors company that include 100+ passport scans, 35 birth certificates, 60+ driver’s licences, and 50+ TFN declarations belonging to employees across Australia, the United States, and Europe.

What Public Reporting Shows

Available reporting describes Baresque Group as a respected commercial-interiors firm headquartered in Perth with additional offices in Dallas, Chicago, and Brussels. The data set posted to the Aurora leak site contains plaintext credentials for every major system the company uses: Microsoft 365, the Elmo Talent HR platform, the LogMeIn remote-access gateway, the 3CX phone system, and the Jim2 ERP. These credentials appear in browser-export CSV files and a master spreadsheet named Password_Listing.xlsx. The exposed identity documents constitute a near-complete kit for identity theft targeting the entire workforce. No confirmed victim count has been released, and the precise date of initial compromise remains undisclosed in current public reporting.

Why This Matters for You and Your Family

When a company you work for, do business with, or have ever given your personal documents to suffers a breach like this, your full identity package can end up on the dark web within days. Passport scans, birth certificates, driver’s licences, and tax file numbers give criminals everything needed to open accounts, file fraudulent tax returns, or impersonate you at government agencies. The plaintext passwords for enterprise systems mean that any employee who reused those credentials at home now faces immediate risk of account takeover on personal email, banking, or social media. Your family members listed as emergency contacts or dependents can also be pulled into the same chain of exposure.

The Doxxing and Identity-Chain Implications

Identity documents rarely stay isolated. A scanned passport linked to an email address can be correlated with usernames found in the credential dump, then tied to social-media handles, gaming accounts, and family addresses. Once attackers map these connections, they can launch targeted doxxing campaigns, SIM-swapping attacks, or extortion attempts that affect every member of a household. Credential leaks of this type frequently cascade into gaming-platform takeovers, especially for children whose parent accounts share the same passwords or recovery emails. Public reporting indicates that such combined datasets accelerate the speed at which a single breach becomes a multi-year identity nightmare.