Major Construction Firms Suffered Data Breaches
Three top contractors reported unauthorized system access that began in July 2026.
Updated on Sept. 29, 2026 in Cybersecurity
Live Poll
Do you trust that most businesses you deal with take adequate steps to prevent data breaches?
Turner Construction, Kiewit, and AECOM experienced unauthorized system access starting in July 2026. The breaches included the exposure of sensitive documents, bank accounts, and social security numbers.
Why it matters
Construction firms are increasingly targeted due to their access to sensitive military installation plans and government project specifications. This sector often lacks robust cybersecurity investment, making them vulnerable to sophisticated attacks using artificial intelligence.
Construction companies ranked cybersecurity as their 10th-largest concern in 2026, while investigation costs for such breaches often exceed hundreds of thousands of dollars. Federal contractors are currently required to follow a 72-hour breach notification timeline.
The players
Turner Construction
This is a large international construction services company that specializes in major public and private infrastructure projects.
Kiewit
Kiewit is one of North America's largest construction and engineering organizations serving various government and commercial sectors.
AECOM
AECOM is a multinational infrastructure consulting firm that manages complex government contracts and large-scale public works.
Granite Construction
This heavy civil construction company is headquartered in Watsonville, California, and achieved Cybersecurity Maturity Model Certification Level 2 in 2026.
The details
Hackers utilized business email compromise to gain control of user accounts and distribute fraudulent invoices. One specific intrusion at Turner Construction allegedly compromised data protected by International Traffic in Arms Regulations.
Timeline
Unauthorized access incidents at the three contractors began in July 2026.
Cyber threats were identified as the top business concern across the United States in 2026.
Roadmap
The industry is struggling to align with strict defense protocols like the Cybersecurity Maturity Model Certification. This transition marks a departure from historic, low-security standards as firms face modern threats from automated, AI-driven cybercriminals.
The compromise of social security and banking information requires affected employees and contractors to monitor their personal credit reports closely for fraudulent activity. Clients of these firms may also see delays in project invoicing as companies implement enhanced authentication protocols.
The takeaway
Contractors handling government data must prioritize securing their digital infrastructure against automated phishing and invoice fraud schemes. Investing in basic cyber hygiene is essential to preventing the high financial costs associated with post-breach forensic investigations.
Further reading
For broader analysis on current digital threats, visit the Cybersecurity section.
Source note: This article includes information reported by Construction Dive.
Live Poll
Do you trust that most businesses you deal with take adequate steps to prevent data breaches?
