Turner Construction discloses July data breach exposing SSNs, salaries and bank accounts of at least 6,098 people

Turner Construction, one of the largest general contractors in the United States, notified at least 6,098 individuals on 18 August 2026 of a data breach that exposed Social Security numbers, salaries, dates of birth, and bank account information used for direct deposit, according to a filing with the California Office of Attorney General.^[1]

What was accessed and when

A Turner investigation determined that unauthorized access to the firm's systems occurred between 2 July and 15 July 2026.^[1] The firm confirmed on 27 July that files containing personal information had been accessed without authorization.^[1]

The exposed data covers both U.S. and Canadian personnel. For U.S. employees, the breach included Social Security numbers; for Canadian staff, Social Insurance Numbers were involved. In both cases, names, dates of birth, salary information, direct-deposit bank account details, and home addresses were also compromised. A limited subset of individuals also had passport numbers exposed.

• Names and dates of birth
• Social Security numbers (U.S.) / Social Insurance Numbers (Canada)
• Salary information
• Bank account details used for direct deposit
• Home addresses
• Passport numbers (limited subset)

The 6,098 figure reflects California residents only. Turner has not disclosed the total number of people affected nationwide.

Ransomware group claims far broader haul

The breach carries a second, more sensitive dimension. Ransomware group Payouts King first posted about an unidentified victim on 24 July 2026. On 11 August 2026, the group revealed Turner's identity on a Tor network site and claimed to have obtained 27.2 terabytes of data.^[1]

According to a dark web posting tracked by class-action site ClaimDEPOT, Payouts King alleged the stolen data extended well beyond personal records - including engineering documents containing restricted and ITAR-protected information, military project files, legal and litigation records, financial records, contracts, and non-disclosure agreements.^[1] Turner has not confirmed those claims, and the company's own regulatory filings address only the personal data categories listed above.

Payouts King is a ransomware operation that emerged in April 2025 with confirmed connections to former BlackBasta affiliates. The group operates a double-extortion model - stealing data before selectively encrypting files - and has claimed more than 50 victims, with the United States representing the largest share of targeted organizations. Construction is among the sectors it has repeatedly targeted.

Notification and remediation

Turner reported the breach to the California Attorney General's Office on 18 August 2026 and began sending written notices to affected individuals the same day. The company is offering five years of complimentary identity protection and credit monitoring through IDX or IDShield, depending on the version of the notice received, including identity-theft insurance and recovery support. The enrollment deadline is 18 November 2026.

Affected individuals can contact Turner's Identity Protection Response Team at 1-866-688-9340 or by email at TurnerIdentityProtection@tcco.com.

What to watch

Turner has stated that its investigation remains ongoing and that regulatory filings may be supplemented as more information becomes available. The gap between the confirmed personal-data exposure and Payouts King's broader claims - particularly the alleged ITAR-protected engineering files and military project records - is the central unresolved question. Law firms have already opened investigations into whether Turner maintained adequate cybersecurity safeguards, and class-action activity is likely to follow. The total number of affected individuals across all U.S. states and Canada has not been disclosed.