DALLAS, September 23 — A national class action firm is investigating data privacy claims tied to a reported breach at AECOM, the multinational infrastructure and engineering group, after a hacker crew claimed to have walked off with a substantial tranche of the company’s data. Edelson Lechtzin LLP, which maintains offices in Pennsylvania and California, announced the investigation on September 20, offering free and confidential case evaluations to AECOM employees, clients and anyone else whose personal information may have been exposed. The announcement went out over PR Newswire from Dallas.
The technical reality, as ever, is messier than the headlines. According to a September 17 post on the dark web monitoring site Ransomware.live, the group Metaencryptor claimed responsibility for a cyberattack on AECOM that allegedly affected about 1.22 TB of data.
The cybersecurity blog HookPhish separately reported that Metaencryptor was behind a suspected attack on the engineering firm. But that is not the only claim in circulation. The dark web monitoring service Breachsense reported an AECOM data leak listed at approximately 670GB, attributed to a group it identified as BrainCipher.
Breachsense also indexed thousands of AECOM-linked credentials circulating online, including 27,434 @aecom.com accounts drawn from external breaches and 6,077 credentials tied to aecom.com itself — among them thousands of logins found in “combo lists” and in infostealer malware logs, many with plaintext passwords. That last detail matters.
Breachsense cautioned that those credentials may belong to either customers or staff, and are not necessarily connected to the claimed attack. Under the hood, credential dumps and ransomware claims are two different animals, and conflating them is a common error in early breach reporting.
What is confirmed — and what is not
The breach has not been confirmed. Important details — its true scope, the specific data involved, and the number of people affected — are not yet publicly available. The specific data involved in the reported AECOM data breach has not been confirmed either.
Data breaches of this kind can expose personal information, increasing the risk of identity theft and fraud. Affected individuals are advised to treat any AECOM breach notification seriously.
The investigation focuses on current and former AECOM employees, clients, and anyone else whose personal information AECOM maintained. Anyone who has received a data breach notification from AECOM may face an increased risk of identity theft and fraud and is encouraged to come forward.
The legal angle
Edelson Lechtzin LLP is investigating a potential class action to pursue legal remedies on behalf of individuals whose sensitive personal data may have been compromised in the reported AECOM breach. A successful case could recover compensation for losses such as lost time, out-of-pocket costs, and loss of privacy, and could push AECOM to strengthen how it protects personal information. The firm will evaluate rights and potential claims at no cost.
Those seeking a free case evaluation can contact Marc Edelson, Esq., Edelson Lechtzin LLP, 411 S. State Street, Suite N-300, Newtown, PA 18940; by phone at 844-696-7492; by email at [email protected]; or via www.edelson-law.com.
Beyond data breach litigation, the firm handles class and collective actions involving securities and investment fraud, federal antitrust violations, ERISA employee benefit plans, wage theft, and consumer fraud. The press release notes it may be considered Attorney Advertising in some jurisdictions and that prior results do not guarantee a similar outcome. The reported data breach and the hackers’ claims described above remain unconfirmed.
What to watch next is straightforward. Whether AECOM confirms the breach, which group — if either — is genuinely behind it, and whether the credential dumps Breachsense indexed turn out to be connected to the claimed attack or simply ambient noise from the wider criminal ecosystem.
Until then, the detail that matters is the one nobody has yet: the actual scope.
