Edelson Lechtzin LLP Probes AECOM After 1.22 TB Theft Claim

Key Takeaways

• Edelson Lechtzin LLP is investigating potential privacy claims tied to an unconfirmed cyberattack involving AECOM.
• Metaencryptor claims the incident involved 1.22 TB of data, while a separate listing attributed roughly 670GB to BrainCipher.
• AECOM has not publicly confirmed the breach, the affected data, or the number of people potentially exposed.

Edelson Lechtzin LLP has opened an investigation into potential data privacy claims involving AECOM after threat actors alleged that they stole a substantial volume of data from the global infrastructure consulting and engineering business.

The inquiry remains preliminary. AECOM has not publicly verified that a breach occurred, explained what systems may have been accessed, or disclosed whether personal, client, or project information was affected. That distinction matters. A claim posted by a criminal group can provide an early warning, but it does not establish the accuracy, origin, or contents of the advertised data.

The allegation surfaced on or about September 17, 2026, through dark web monitoring services. Ransomware.live reported that Metaencryptor had claimed responsibility for an attack affecting approximately 1.22 terabytes of data. HookPhish also connected Metaencryptor to the suspected AECOM incident.

A separate entry reported by Breachsense described an AECOM leak of roughly 670GB and attributed it to BrainCipher. It is unclear whether the two claims refer to the same underlying event, separate compromises, duplicated files, or data assembled from earlier sources. Are two threat actors describing overlapping material? At this stage, the public record does not answer that question.

Breachsense also indexed 27,434 accounts using the @aecom.com domain that appeared in external breaches, along with 6,077 credentials associated with aecom.com itself. Some reportedly appeared in combo lists and infostealer malware logs, including records containing plaintext passwords. Breachsense cautioned that the credentials could belong to customers or employees and might have no connection to the newly alleged attack.

That caveat is important. Credentials collected through unrelated website compromises, reused passwords, infected personal devices, and historical data sets are frequently grouped around a corporate domain. Their presence online may create account-takeover risk, but it does not independently prove that AECOM’s internal network was breached.

Volume alone says little about severity. A terabyte of duplicated technical files can carry a different risk profile from a smaller collection containing Social Security numbers, payroll records, identity documents, financial details, or protected client information. Investigators will need to determine what was acquired, when access occurred, how the attackers entered, and whether the material is authentic.

AECOM’s role adds another layer. Its operations span infrastructure consulting, engineering, design, and construction management, meaning its systems may hold information connected to current and former employees, clients, contractors, and projects. There is no public confirmation that any particular category was exposed. Still, the range of possible stakeholders makes careful scoping especially relevant.

The technical response would typically involve preserving logs and system images, containing unauthorized access, resetting exposed credentials, and tracing any movement across connected environments. NIST SP 800-61 Rev. 2 provides a widely used model for incident handling, while NIST SP 800-53 Rev. 5 addresses safeguards such as access controls, audit logging, and monitoring.

For businesses working with government agencies and public infrastructure, coordination can become just as significant as containment. CISA recommends rapid evidence preservation and coordinated legal, technical, and communications work during cyber incidents. ISO/IEC 27001:2022 also gives engineering and construction-adjacent businesses a governance structure for assessing security risks and improving controls over time.

Edelson Lechtzin LLP said its investigation concerns current and former AECOM employees, clients, and others whose personal information AECOM maintained. The law firm is offering free, confidential case evaluations, but no class action outcome has been established. The release may constitute attorney advertising in some jurisdictions.

For potentially affected individuals, the practical steps are straightforward: retain any notice received from AECOM, monitor financial and online accounts, review credit reports, change reused passwords, and consider fraud alerts or credit monitoring where appropriate. Until AECOM confirms the incident and identifies the records involved, the alleged scale, legal exposure, and business consequences remain unresolved.