For nearly two weeks, Turner Construction experienced a data breach that hackers claim included military project files, nondisclosure agreements and personal information. 

On Aug. 18, the company confirmed the cyberattack, which occurred between July 2 and July 15, in letters to more than 13,000 potentially affected individuals, according to attorneys general disclosures in four different states.

In the letters, Turner said the leaked information includes Social Security numbers, bank account information and passport numbers, but it didn’t say whether government secrets were obtained. 

Ransomware group Payout Kings claimed responsibility for the hack in a post on the dark web, saying it had obtained 27.2 terabytes of data from Turner. 

The group said the compromised data includes engineering documents with employees’ personal data, military project files, legal and litigation records, correspondence, financial records, contracts, NDAs and other agreements. Some of the information is reportedly restricted under the International Traffic in Arms Regulations — rules regarding the import and export of defense-related items to protect national security — according to Claim Depot, which first reported the incident. 

In a statement to Bisnow, a spokesperson for Turner said it “does not comment on claims made by criminal organizations.”

“The confidentiality, privacy, and security of information within our care are among Turner's highest priorities,” the statement says. “We will continue to support those impacted by this incident and further enhance our existing security measures.”

New York City-based Turner is the largest general contractor in the U.S., with $2.8B in government awards, according to federal contract and grant tracker HigherGov. The company also specializes in data center construction, with a $44.3B backlog, more than a third of which comes from hyperscaler projects.

The breach has so far impacted 6,098 California residents, 3,683 Texas residents, 3,643 Massachusetts residents and 38 Vermont residents, according to the respective attorneys general's disclosures.

In response to the breach, Turner has hired third-party cybersecurity and forensic experts to conduct an investigation. A detailed review is ongoing, according to the company. 

Turner is offering those impacted access to credit monitoring services for five years. It has also provided instructions for monitoring and protecting financial and online accounts.

Federal law enforcement, state regulators and major credit reporting agencies have been notified. Other individuals and parties will be notified as necessary, according to Turner.