AECOM listed on Metaencryptor leak site with claims of data breach

• Ransomware group: Metaencryptor
• Country: United States
• Sector: Professional Services
• Announcement date: September 17, 2026

The Metaencryptor ransomware group has listed the global infrastructure consulting firm AECOM on its leak site. According to the announcement made on September 17, 2026, the threat actor claims to have compromised a significant amount of data belonging to the organization.

The alleged breach involving AECOM

The threat actor known as Metaencryptor has listed an alleged data breach involving AECOM on its leak site. The group claims that the attack occurred on September 17, 2026. According to the group's announcement, the breach involves data related to the company's infrastructure projects. Information regarding the specific identity and background of the Metaencryptor group remains limited.

In modern cyberattack scenarios, ransomware groups often employ a tactic known as double extortion. This method involves not only encrypting a victim's systems to disrupt operations but also exfiltrating sensitive data prior to the encryption phase. The threat actors then threaten to publish the stolen information on a public leak site if the ransom demand is not met. This pressure tactic aims to maximize the impact of the attack by threatening the victim's reputation and legal standing.

Data involved in the claim

The Metaencryptor group claims to be in possession of 1.22 TB of data. However, the listing does not specify the exact number of files involved. Based on the available information from the leak site, the following details regarding the content are known:

• The listing names no specific data types.

>

The provided screenshots indicate that no files have been published by the group yet. Because the files have not been released, specific details regarding the exact types of data contained within the 1.22 TB volume remain unknown at this time.

About AECOM

AECOM is a global infrastructure consulting firm that provides design, engineering, construction management, and advisory services for infrastructure projects in sectors such as transportation, water, energy, and the environment. It serves public and private sector clients worldwide.

Potential implications and risks

The alleged breach, considering AECOM's large-scale infrastructure projects, may present risks regarding the exposure of corporate operational data and sensitive client information. As a U.S.-based entity, a potential data breach may be subject to state-level privacy laws and relevant regulatory frameworks. The publication of such data could potentially impact the company's reputation within the public and private sectors.

Furthermore, the leaked data may potentially be utilized in secondary risks such as targeted phishing campaigns or corporate espionage. When large volumes of corporate data are exfiltrated, attackers often use the information to craft highly convincing social engineering attacks against employees or clients, or to gain further access to interconnected supply chains.

For organizations operating in the professional services and infrastructure sectors, maintaining robust cybersecurity postures is essential. Common defensive steps typically include implementing multi-factor authentication across all services, maintaining rigorous patch management schedules, and conducting regular security awareness training for employees. Additionally, organizations often rely on network segmentation and continuous monitoring to detect unauthorized data exfiltration attempts early in the attack lifecycle.