AECOM Hit by Alleged Data Breach: Hacker Group Metaencryptor Claims 1.22TB of Stolen Data On September 17, 2026, the hacker group Metaencryptor claimed responsibility for a suspected cyberattack on AECOM, a Texas-based multibillion-dollar infrastructure consulting firm. According to reports from dark web monitoring site Ransomware.live, the breach may have compromised 1.22 terabytes of data, with the attack allegedly occurring the same day the claim was posted. Details about the scope and nature of the breach remain unconfirmed, including whether sensitive employee or client data was exposed. Legal teams, including those affiliated with ClassAction.org, are investigating the incident to determine if a class action lawsuit can be filed on behalf of affected individuals particularly current and former AECOM employees who believe their information may have been put at risk. At this stage, no official statement from AECOM has been released regarding the breach. The investigation is ongoing, with attorneys seeking input from potentially impacted parties to assess damages, which could include loss of privacy, financial costs, and other harm if the breach is verified. The outcome of any legal action could also compel AECOM to strengthen its data protection measures.

The California Office of the Attorney General reported a data breach involving AECOM Technology Corporation on July 8, 2014. The breach potentially exposed employee personal information, including names, addresses, Social Security numbers, and bank account details, although it is unknown how many individuals were affected.