On September 21, 2026, at 07:45 UTC, the extortion group Storm posted "TrueCore Behavioral Solutions" to its leak site, per ransomware.live. TrueCore is a Tampa contractor to the Florida Department of Juvenile Justice for residential treatment of adjudicated youth. Storm has 64 listings since August 7, including Insight Credit Union the week before. The TrueCore entry describes the company, not what was taken. Every fact about an intrusion is the attacker's claim. No breach at TrueCore is confirmed.
The reflex is to open the company's website and look for a notice. As of September 22, truecorebehavioral.com serves a Polish online-casino page.
What the domain did between May and September
Each step reproduces with the Wayback Machine, whois, dig and curl.
- May 11, 2026. Wayback capture
20260511091739is TrueCore's own homepage: "© 2026 TrueCore Behavioral Solutions" and a Department of Juvenile Justice link in the navigation. - June 11, 2026. Capture
20260611171333is 795 bytes: a GoDaddy parking lander containingwindow._trfd.push({ap:"parking"}). - September 7, 2026. The registry WHOIS record reads
Updated Date: 2026-09-07T08:55:15Z. The creation date is unchanged at 2017-05-11, the expiry now reads 2028-05-11, registrant Domains By Proxy, nameservers Cloudflare. - September 21, 2026. The Storm listing.
- September 22, 2026. A fetch with three user agents returns
<html lang="pl">, the title "NV Casino Polska 2026," and a canonical tag pointing at a.clickcasino host.dig MX truecorebehavioral.comreturns nothing. The DJJ contract-provider page for TrueCore, fetched the same day, still linkshttps://truecorebehavioral.com/.
This is not a defacement but aftermarket-domain SEO: the page is identical across user agents, its canonical tag points elsewhere, and someone is pointing years of inbound links at whatever pays. The creation date did not reset and the expiry was extended, which fits an aftermarket transfer as well as anything else. The records show that the domain changed hands, not how. Whether or not the company still operates is a separate question this piece does not need to answer.
A domain is a credential with no expiry reminder
Every organisation has domains that no longer host anything: a retired brand, an acquired subsidiary, the old primary domain after a rename. The renewal notice for each goes to a mailbox that is often on that same domain, or belongs to whoever set it up in 2017. Nothing in the security stack lists a domain that resolves to nothing.
The addresses on that domain keep being referenced after the hosting stops. Every SaaS login created with an @truecorebehavioral.com address, every vendor portal and every partner directory still points there. Today there is no MX record, so mail to those addresses bounces. Whoever controls the zone can add one in an afternoon, and from then on every password reset arrives at a stranger. That is the new holder's decision, not the old owner's.
The practice: reconcile every domain you ever registered against every domain you still control
Build two lists. The first is every domain the organisation has ever registered: exports from every registrar account; accounts-payable searches for registrar names; certificate-transparency lookups on the organisation name; and the memory of the longest-serving person in IT. The second is every domain whose registrar account you can log into today. The difference is the finding.
For each domain on the first list and not the second, run whois, dig MX and curl. Then search your identity provider and SaaS admin consoles for addresses on it. Anything that still authenticates with such an address is an account-takeover path with no CVE. The fix is to change the address on the account, not to buy the domain back.
For each domain on the second list, renew for the longest term the registry allows, which for .com is ten years. Put the renewal contact on an address that is not on the domain being renewed, turn on registrar lock, and consolidate into one registrar account behind MFA. The cost is a few hundred dollars per domain per decade and an afternoon per domain to move. The real cost is organisational: the reconciliation surfaces domains no team wants, and someone has to be made to own each one. For the ones you release, retire every account that references them first, then check quarterly what they serve and whether an MX record has appeared.
If you are a state agency or a prime contractor, run the same check on your provider directory. You cannot manage a partner's identity, but you can fetch each URL you publish. A link from your .gov page is part of what made that domain worth acquiring.
What to check this week
- How many domains has the organisation ever registered, and how many can you name without looking? The gap is the audit.
- For every domain you hold, does the renewal notice go to an address on a different domain?
- For every domain you no longer hold, run
dig MX. If a record has appeared, list every account that still uses an address there. - If you publish a directory of vendors or partners, when did anyone last fetch every URL in it?
A leak-site listing goes public on the attacker's schedule. This piece is about what was already true before Storm posted: the company's most public identity had been someone else's for months, and nobody who relied on it had noticed.
North InfoSec runs AI-assisted penetration testing and security assessments, including the domain and identity reconciliation described above. northinfosec.com