Major US construction company discloses data breach affecting customer data

American construction company Turner Construction has revealed a major cyber security incident that exposed the sensitive personal information belonging to its customers.

 

Turner Construction Company is a prominent U.S.-based construction services provider and one of the country’s largest general contractors. Headquartered in New York City, the company operates as a subsidiary of global construction group Hochtief. Turner oversees more than $28 billion in annual project volume and specializes in large-scale projects across commercial, healthcare, education, sports, and aviation infrastructure.

 

In a data security notice submitted to the California Attorney General’s Office, Turner Construction said that it recently identified unauthorised access to its internal network. The company immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

It also took steps to secure the affected network and notified relevant law enforcement authorities about the incident.

 

“The investigation determined that there was unauthorised access to certain Turner systems between July 2 and July 15, 2026. On July 27, 2026, Turner confirmed that files containing personal information had been accessed without authorisation,” Turner Construction said.

 

The compromised data included names, Social Security numbers, Social Insurance Number (for individuals in Canada), passport numbers, dates of birth, salary details, bank account information used for direct deposit, and home addresses.

 

While the total number of affected individuals has not yet been confirmed, Turner Construction disclosed in filings with state attorneys general that the breach has so far affected 6,098 California residents, 3,683 Texas residents, 3,643 Massachusetts residents, and 38 Vermont residents. 

 

Although the construction company found no indication that the exposed information had been misused, it urged affected individuals to remain vigilant by regularly reviewing their credit reports, account and benefits statements, and to report any suspicious activity to law enforcement agencies, including local police and the state attorney general.

 

It has also offered five years of complimentary credit monitoring services through IDShield to all affected individuals.

 

 

 

The Payouts King ransomware group has claimed responsibility for the cyberattack on Turner Construction, listing it as a victim on its data leak site. The group said it exfiltrated 27.2 TB of confidential data and published the company’s full domain on its dark web portal, suggesting that ransom negotiations may have failed.