BrainCipher

Profile narrative

BrainCipher is an alias used by a threat actor that emerged in public reporting concerning a cyber incident against AECOM on September 17, 2026, as noted in a PRNewswire press release describing alleged data theft and ensuing class‑action claims by Edelman Lechtzin LLP. On that date the hacker group Metaencryptor claimed responsibility for an intrusion that allegedly involved approximately 1.22 terabytes of data. A separate dark web monitoring service later reported a roughly 670‑gigabyte leak that it attributed to BrainCipher, specifying that the leaked material included an index of thousands of credentials linked to AECOM. The same monitoring service cautioned that the indexed credentials might not be connected to the intrusion claimed by Metaencryptor, highlighting uncertainty about the leak’s provenance. Because the AECOM breach remains unconfirmed by independent sources, the exact relationship between BrainCipher and the reported incident cannot be definitively established from the available information. The PRNewswire article itself serves as the primary public source for the allegations surrounding this actor’s activity on the stated date.

According to the monitoring service, the potential impact of the BrainCipher‑associated leak could extend to current and former employees, clients, and any other individuals whose information AECOM maintained, though the service did not publicly establish the scope, data types, or number of people actually affected. No additional campaigns, malware families, initial access vectors, or tooling styles have been publicly linked to BrainCipher in the sources consulted. Likewise, no state nexus, criminal consortium affiliation, or clear strategic objective such as financial gain, espionage, or disruption has been demonstrated for this actor. Consequently, the public record of BrainCipher is limited to the single AECOM‑related leak report, the associated cautions about its veracity, and the lack of further substantiated details regarding its operations or motives.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 0 sources.