Dive Brief:
- Turner Construction notified at least 6,098 individuals on Tuesday of a data breach that included Social Security numbers, salaries, dates of birth and bank account information for direct deposit, according to a filing with the California Office of Attorney General.
- A Turner investigation determined there had been unauthorized access to the firm’s systems between July 2 and July 15, per the filing. The firm confirmed on July 27 that files containing personal information were accessed without authorization. Some files may also have contained individuals’ passport numbers, the filing said.
- Ransomware group Payouts King claimed responsibility and said the compromised data went beyond personal information, including engineering documents, military project files, contracts and non-disclosure agreements, among other records, according to a post on ClaimDEPOT, a class-action lawsuit tracker.
Dive Insight:
New York City-based Turner issued the following statement to Construction Dive:
“Upon discovering unauthorized access to certain systems, Turner engaged leading third-party cybersecurity and forensic experts to investigate. They continue to conduct a detailed review of the files involved. We are notifying individuals and other parties as necessary. Turner is providing complimentary identity protection services.
“The confidentiality, privacy, and security of information within our care are among Turner's highest priorities. We will continue to support those impacted by this incident and further enhance our existing security measures.
“Turner does not comment on claims made by criminal organizations.”
According to ClaimDEPOT, Payouts King first posted information about an unidentified victim on July 24, before identifying Turner on Aug. 11. The group posted via a Tor network site, which masks users’ locations and identities, claiming it had obtained 27.2 terabytes of data.
In addition to the types of files listed by the California attorney general, Payouts King claimed it accessed documents protected by International Traffic in Arms Regulations, a set of U.S. government rules regarding the export and import of military items, technology and services.
Turner is offering to provide identity protection services for five years through IDShield and IDX, according to the notices sent out to affected individuals filed with the California AG’s office. One of the two notices designated a Nov. 18 deadline to enroll.
Several construction-related domains have been targeted by threat actors recently, according to an Aug. 6 post on Google’s Threat Intelligence blog that designates potentially compromised sites.
Turner is the largest contractor in the industry by revenue and maintains a core focus on data centers and advanced technology builds. The booming data center sector helped it build a $44.3 billion backlog at the end of 2025.
Several law firms posted notices of investigations into the Turner incident, seeking plaintiffs for potential class action lawsuits.
Turner also reported that at least 38 Vermont residents were affected by the breach, according to the Office of the Vermont Attorney General.
