Construction — Cyber Threat Activity
Threat actors, incidents and malware targeting the Construction sector — 473 recorded incidents and 52 tracked groups.
- Recorded incidents: 473
- Incidents, trailing 180 days: 191
- Tracked threat actors: 52
- Malware families: 0
Recent incidents
- Kruse Construction 2026-07-22
- P & A Construction 2026-07-22
- Byggelit Sverige 2026-07-16
- Ferrovial 2026-07-15
- Pioneer Construction 2026-07-15
- Arkın Group 2026-07-14
- WBF Construction 2026-07-14
- Eureka Construction INC 2026-07-12
- Bancroft Engineering 2026-07-11
- Aveiro Constructors Limited 2026-07-11
- Access Equipment Hire 2026-07-11
- Welders Supply Equipment Rentals 2026-07-11
- Weinberg ''93 Építő Kft. 2026-07-10
- CRZ Construcciones 2026-07-10
- Roofinox 2026-07-10
- The Schuett Companies 2026-07-10
- EBNY Development 2026-07-07
- Lechner Massivhaus GmbH 2026-07-07
- Keystone Homes 2026-07-06
- bmiprojects.de 2026-07-06
Threat actors targeting Construction
- Qilin 98 incidents
- Akira 85 incidents
- Play Ransomware 63 incidents
- DragonForce 45 incidents
- SafePay 21 incidents
- INC Ransom 19 incidents
- Lynx Ransomware 17 incidents
- LockBit 16 incidents
- The Gentlemen 14 incidents
- NightSpire 12 incidents
- Cl0p 9 incidents
- Medusa Ransomware 9 incidents
- RansomHub 8 incidents
- Sarcoma 4 incidents
- AiLock 3 incidents
- Coinbase Cartel 3 incidents
- RansomHouse 3 incidents
- Settra 2 incidents
- BianLian 2 incidents
- Genesis 2 incidents
- Gunra 2 incidents
- KillSec 2 incidents
- Nova 2 incidents
- Payload 2 incidents
Where these victims are
- United States 260
- United Kingdom 32
- Canada 24
- Australia 12
- Germany 12
- France 9
- Italy 9
- Austria 5
- Malaysia 4
- Spain 4
- Switzerland 4
- Singapore 3
Coverage. 76.7% of incidents in our log carry a sector classification; the remainder name a victim we have not placed in an industry. Counts here are a floor, not a total, and are not comparable between sectors of different sizes.