Turner Construction Company

Summary

Turner Construction Company experienced a cybersecurity incident that involved unauthorized access to its systems over a two‑week period. The breach exposed personal data including names, Social Security numbers, dates of birth, salaries, direct deposit bank account information, passport numbers and home addresses of thousands of individuals, with at least six thousand notified and additional residents in Vermont affected. The firm engaged third‑party cybersecurity and forensic experts to investigate and is providing complimentary identity protection services for five years through IDShield and IDX. A ransomware group claimed responsibility, asserting that it also obtained engineering documents, military project files, contracts, non‑disclosure agreements and ITAR‑protected material amounting to tens of terabytes. Several law firms have opened investigations into the incident, seeking potential plaintiffs for class action.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Turner Construction Company experienced a cybersecurity incident that involved unauthorized access to its systems between July 2 and July 15, 2026, as determined by an internal investigation and confirmed on July 27, 2026 when the company verified that files containing personal information had been accessed without authorization. The breach was discovered after Turner detected the unauthorized activity and subsequently engaged leading third‑party cybersecurity and forensic experts to conduct a detailed review of the affected systems. According to a filing with the California Office of the Attorney General, Turner notified at least 6,098 individuals on Tuesday (the notice date referenced in the filing) about the compromise of their personal data. The company also reported that at least 38 Vermont residents were among those affected, based on a notice submitted to the Vermont Attorney General’s Office.

The exposed information included names, Social Security numbers, dates of birth, salaries, direct deposit bank account details, passport numbers and home addresses, as stated in both the press release from Edelson Lechtzin LLP and the California Attorney General filing. In addition to personal data, the ransomware group Payouts King claimed responsibility for the intrusion and asserted that it had exfiltrated 27.2 terabytes of data, which encompassed engineering documents, military project files, contracts, non‑disclosure agreements and other records protected under the International Traffic in Arms Regulations. Payouts King first posted information about an unidentified victim on July 24, 2026 on a Tor‑hidden service site and later identified Turner Construction as the target on August 11, 2026, according to the class‑action tracking website ClaimDEPOT. The group’s statements indicated that the compromised data extended beyond employee personal information to include proprietary and government‑related files.

In response to the incident, Turner Construction provided complimentary identity protection services for five years through the providers IDShield and IDX, as outlined in the notices sent to affected individuals filed with the California Attorney General’s office, with one of the notices specifying a November 18, 2026 deadline for enrollment. The company continued to cooperate with the third‑party forensic experts who were conducting a detailed review of the files involved and stated that it would notify individuals and other parties as necessary. Simultaneously, several law firms, including Edelson Lechtzin LLP and Federman Sherwood, announced investigations into the breach and began seeking plaintiffs for potential class action lawsuits on behalf of those whose sensitive personal data may have been compromised. Turner emphasized that the confidentiality, privacy and security of information within its care remain among its highest priorities and said it would continue to support those impacted while enhancing its existing security measures.

Sources

Sources available to members: 3 sources.