A ransomware group claims to have stolen a large cache of data from Duarte Nursery, Inc., including employee Social Security numbers, owner identity details, and bank account information. The company has not confirmed this breach. Affected individuals should monitor credit reports, consider a credit freeze, and watch for phishing attempts referencing this incident.
| Company | Duarte Nursery, Inc. |
|---|---|
| Industry | Food Distribution |
| Data Types Exposed | Social Security Numbers, Dates of Birth, Driver’s License Number, Bank Account and Routing Numbers, Financial Statements, Litigation Documents, Proprietary Business Data, Salary and 401(k) Information |
| People Affected | Not Publicly Disclosed |
| Attack Method | Ransomware |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Duarte Nursery, Inc. Data Breach?
A ransomware group has claimed responsibility for stealing data from Duarte Nursery, Inc., a wholesale fruit and nut tree nursery based in Hughson, California. The group posted its claim on a dark web leak site, stating it holds what it describes as the company’s complete digital footprint. Duarte Nursery has not publicly confirmed this incident, so the Duarte Nursery data breach claim should currently be treated as unverified.
According to the claim, the attackers accessed years of sensitive business records. This reportedly includes California state tax filings spanning 2024 through 2026, payroll processing files, litigation documents, and proprietary agricultural data. No specific discovery date has been publicly disclosed, and the timeline of the alleged intrusion remains unclear.
Because the company has not issued a statement, it is not known whether Duarte Nursery is conducting a forensic investigation. As a result, affected individuals currently have no official confirmation of what happened or when. Until the company responds, the scope and accuracy of the leak site’s claims cannot be independently verified.
Who was affected?
The leaked dataset reportedly names several distinct groups. These include current and former employees whose payroll and tax information may appear in quarterly state filings. The data set allegedly also includes the company’s two owners, John and Jeff Duarte, whose personal identity details are specifically named in the claim.
In addition, the claim references roughly 100 employees tied to direct deposit payroll files, along with 23 salaried staff members whose compensation and benefits data allegedly appears in the stolen files. The exact total number of affected individuals has not been publicly disclosed. Because this is an agricultural employer, seasonal and administrative staff across California’s Central Valley could potentially be included.
What Information Was Potentially Exposed?
The ransomware group’s claim lists a range of specific data categories allegedly taken from the company’s systems. Because Duarte Nursery has not confirmed the incident, these categories should be understood as allegations rather than verified fact. Based on the claim, the reportedly exposed information includes the following.
- Full Social Security numbers from state employment tax filings
- Owners’ Social Security numbers, dates of birth, and driver’s license number
- Bank account and routing numbers for employees via payroll direct deposit files
- Company bank account credentials and wire transfer instructions
- Reviewed financial statements
- Litigation documents from active lawsuits
- Proprietary rootstock and grafting business data
- Salary, insurance, tax return, and 401(k) census information for salaried employees
If accurate, this combination of data would be unusually complete. Social Security numbers paired with dates of birth and driver’s license numbers give criminals nearly everything needed to open new credit accounts. This is because lenders often rely on exactly these identifiers to verify applicants.
Furthermore, the alleged inclusion of bank account and routing numbers raises the risk of direct financial fraud, not just identity theft. For example, criminals could attempt unauthorized withdrawals or redirect payroll deposits. Because the claim also names company banking credentials, there is a risk of business email compromise or wire fraud schemes targeting vendors and partners.
What is the company doing?
Duarte Nursery has not publicly confirmed this breach, and no statement from the company has been identified. Therefore, it is not currently known whether the company has launched an internal investigation, retained forensic experts, or notified affected individuals. Readers should treat any claims about company action as unconfirmed until Duarte Nursery speaks publicly.
Similarly, no information is available about whether credit monitoring or identity protection services have been offered to employees or the owners. Because ransomware leak site claims are not independently verified disclosures, affected individuals should watch for an official notification letter from the company. Anyone who worked at or does business with Duarte Nursery may want to proactively monitor their accounts in the meantime.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Affected individuals should request free copies of their credit reports from Equifax, Experian, and TransUnion. Reviewing these reports regularly helps catch new accounts or inquiries you did not authorize. This is especially important given the claim that full Social Security numbers were involved.
In addition, consider setting up ongoing credit monitoring through your bank or a third-party service. Because fraudulent activity can appear months after a breach, a single check is not enough. Regular monitoring over the next year gives you a much better chance of catching problems early.
Consider a Credit Freeze or Fraud Alert
Because the claim describes exposure of Social Security numbers, dates of birth, and a driver’s license number, a credit freeze is a strong protective step. A freeze blocks lenders from accessing your credit file, which stops most new account fraud before it starts. You can request a freeze for free with each of the three major credit bureaus.
Alternatively, a fraud alert requires lenders to take extra verification steps before approving new credit in your name. This option is less restrictive than a freeze but still adds a meaningful layer of protection. Either step is reasonable given the sensitivity of the data allegedly involved here.
Watch for Phishing and Impersonation Attempts
Because this incident reportedly involves names, financial account details, and employment information, scammers may use that data to craft convincing phishing messages. Be cautious of emails or calls claiming to be from Duarte Nursery, your bank, or a government agency. Never click links or share personal details unless you can verify the sender independently.
As a precaution, contact companies directly using phone numbers from official statements or your account documents, not numbers provided in a suspicious message. This simple habit blocks most impersonation attempts. If you receive a message referencing this breach, treat it with extra skepticism.
Protect Your Bank Accounts
Given the claim that employee bank account and routing numbers were included in stolen payroll files, affected individuals should contact their bank proactively. Ask about setting up transaction alerts so you are notified of any unusual activity immediately. Some banks can also flag or restrict ACH transactions tied to payroll on request.
Moreover, review recent bank statements carefully for any unauthorized withdrawals or deposits you don’t recognize. If you spot anything suspicious, report it to your bank right away. Acting quickly often determines whether you can recover lost funds.
Consult a Data Breach Attorney
If you believe your information was included in this claimed breach, speaking with a data breach attorney can help clarify your legal options. Many offer free case evaluations and only collect fees if your case succeeds. An attorney can also help you understand whether you may be eligible to join a class action if one is filed.
In the meantime, keep records of any suspicious financial activity, time spent on credit monitoring, or any direct financial losses. This documentation can strengthen your position if litigation develops. Acting early also helps you stay within any applicable filing deadlines.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.