Thomas Y. Pickett & Co., Inc.
Data leak attributed to aurora, first discovered on 2026-10-05. Approximately 534,163 records were reported exposed.
33458
About this leak
[consulting] Thomas Y. Pickett & Co., Inc. — founded in 1926, headquartered in Addison/Dallas, Texas — is one of the oldest property tax appraisal consulting firms in the United States. They appraise mineral, industrial, and utility properties for county appraisal districts across Texas, Wyoming, North Dakota, Mississippi, Oklahoma, and beyond. Roughly 40 employees, ~$5.3M annual revenue, nearly a century of reputation. Inventory: 13 SQL Server database backups (127 GB) including the 102 GB TYPortal web portal database containing all property owner records and user credentials Complete HR records for all 40+ employees — Social Security cards, W-4s, direct deposit forms, salary schedules, medical records, termination documents, TWC hearing notices 11 GB Azure DevOps repository — the entire source code history, including a 6,105-line proprietary COBOL program (NOTICE14) that generates tax appraisal notices 200+ client contracts with pricing for every county appraisal district they serve — the competitive intelligence gold mine Complete financial records — bank statements (PNC and Frost), 10-year budget, accounts receivable, payroll, and evidence of a prior fraud incident in May 2025 A developer's password exposed in a directory name visible to anyone who looks at the file listing A PKCS#12 digital signing certificate (private key) for an HR manager — enabling document forgery