Quick Overview

  • Turner Construction notified at least 6,098 individuals on Tuesday (date not disclosed) that its data breach involved Social Security numbers, salaries, dates of birth, and bank account information used for direct deposits, according to documents filed with the California Attorney General's office.
  • Turner's investigation revealed that between July 2 and July 15, its systems were subject to unauthorized access. The company confirmed on July 27 that files containing personal information were accessed without authorization. Some files may also have contained individuals' passport numbers, the filing stated.
  • The ransomware group Payouts King claimed responsibility for the incident and stated that the leaked data was not limited to personal information, but also included records such as engineering files, military project documents, contracts, and non-disclosure agreements, according to a post on the class action tracking website ClaimDEPOT.

Deep Dive

New York City-based Turner issued the following statement to Construction Dive:

"After discovering unauthorized access to certain systems, Turner engaged leading third-party cybersecurity and forensic experts to investigate. They continue to conduct a detailed review of the files involved. We are notifying affected individuals and other parties. Turner is providing complimentary identity protection services."
"The confidentiality, privacy, and security of information in our care is one of Turner's top priorities. We will continue to support those affected by this incident and further enhance our existing security measures."
"Turner does not comment on the claims of criminal organizations."

According to ClaimDEPOT, Payouts King first posted information about an unidentified victim on July 24, then confirmed the victim as Turner on August 11. The group posted the information via a Tor network site, which can hide users' locations and identities, and claimed to have obtained 27.2 TB of data.

In addition to the file types listed by the California Attorney General, Payouts King also claimed to have accessed files protected by the International Traffic in Arms Regulations, a set of U.S. government regulations governing the import and export of military items, technology, and services.

According to the notices filed with the California Attorney General's office, Turner is offering affected individuals five years of identity protection services through IDShield and IDX. One of the notices specified a registration deadline of November 18.

Recently, multiple construction-related domains have become targets of threat actors, according to an August 6 post on the Google Threat Intelligence blog, which listed potentially compromised websites.

Turner is the highest-revenue contractor in the industry and focuses on data center and advanced technology construction. The booming data center industry helped it accumulate a $44.3 billion backlog by the end of 2025.

Several law firms have issued notices about investigations into the Turner incident, seeking plaintiffs for potential class action lawsuits.

Turner also reported that at least 38 Vermont residents were affected by the breach, according to the Vermont Attorney General's office.