Hamilton Construction Company, a heavy civil contractor based in Springfield, Oregon, experienced a data breach on June 19, 2025, when unauthorized actors accessed its network. The breach exposed highly sensitive personally identifiable information (PII) of affected individuals, including names, dates of birth, addresses, Social Security/taxpayer ID numbers, passport numbers, state-issued ID card numbers, financial/banking details, health insurance policy/ID numbers, and medical information. The company confirmed the breach after a preliminary review (completed by October 7, 2025) and notified 610 Washington residents among other affected parties. While Hamilton took remedial steps—such as engaging law enforcement, regulatory bodies, and credit agencies—the breach posed severe risks, including identity theft, financial fraud, and long-term reputational harm. The exposed data, particularly financial, medical, and government-issued identifiers, heightens the potential for malicious exploitation, making this a high-stakes incident for both employees and customers.
Source: https://www.claimdepot.com/investigations/hamilton-construction-company-data-breach-2025
TPRM report: https://www.rankiteo.com/company/james-hamilton-construction-co
"id": "jam3294132111825",
"linkid": "james-hamilton-construction-co",
"type": "Breach",
"date": "6/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': '610 (Washington residents '
'reported; total number '
'unspecified)',
'industry': 'Construction (Heavy Civil Contractor)',
'location': 'Springfield, Oregon, USA',
'name': 'Hamilton Construction Company',
'type': 'Private Company'}],
'customer_advisories': ['Free identity theft protection services (Epiq) '
'offered',
'Guidance on monitoring financial accounts and credit '
'reports',
'Instructions for placing fraud alerts',
'Legal support for compensation claims'],
'data_breach': {'data_exfiltration': True,
'number_of_records_exposed': 'At least 610 (Washington '
'residents; total unspecified)',
'personally_identifiable_information': True,
'sensitivity_of_data': 'High (includes SSNs, financial, '
'passport, and medical data)',
'type_of_data_compromised': ['Personally Identifiable '
'Information (PII)',
'Financial Data',
'Health/Medical Data']},
'date_detected': '2025-06-19',
'date_publicly_disclosed': '2025-10-07',
'description': 'Shamis & Gentile P.A. is investigating the Hamilton '
'Construction Company data breach, where unauthorized access '
'to certain systems exposed sensitive personally identifiable '
'information of affected individuals. The breach was '
'discovered on June 19, 2025, and notifications began on '
'October 7, 2025. The exposed data included names, dates of '
'birth, addresses, Social Security numbers, passport numbers, '
'financial information, and medical details. Hamilton notified '
'law enforcement, regulatory authorities, and credit reporting '
'agencies, and offered free identity theft protection services '
'to affected individuals.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'exposure of sensitive personal data',
'data_compromised': ['Name',
'Date of Birth',
'Address',
'Social Security or taxpayer ID number',
'Passport number',
'State-issued ID card number',
'Financial and banking information',
'Health insurance policy or ID number',
'Medical information'],
'identity_theft_risk': 'High (due to exposure of SSNs, financial, '
'and medical data)',
'legal_liabilities': 'Potential lawsuits and compensation claims '
'from affected individuals',
'payment_information_risk': 'High (financial and banking '
'information exposed)'},
'investigation_status': 'Ongoing (as of the description; preliminary review '
'completed by 2025-10-07)',
'recommendations': ['Sign up for free Epiq identity theft protection services',
'Monitor financial accounts for suspicious activity',
'Place a fraud alert on credit reports',
'Request free annual credit reports from major bureaus',
'Seek legal assistance for potential compensation'],
'references': [{'source': 'Shamis & Gentile P.A. Investigation Notice'},
{'source': 'Washington Attorney General Breach Notification '
'(2025-11-12)'}],
'regulatory_compliance': {'legal_actions': 'Potential lawsuits by affected '
'individuals (e.g., Shamis & '
'Gentile P.A. investigating '
'compensation claims)',
'regulatory_notifications': ['Washington Attorney '
'General (notified on '
'2025-11-12)',
'Federal law '
'enforcement',
'Relevant regulatory '
'authorities',
'Three major credit '
'reporting agencies']},
'response': {'communication_strategy': 'Notifications sent to affected '
'individuals, Washington Attorney '
'General, federal law enforcement, and '
'credit reporting agencies. Free '
'identity theft protection services '
'(Epiq) offered to victims.',
'incident_response_plan_activated': True,
'law_enforcement_notified': True},
'stakeholder_advisories': 'Notifications sent to affected individuals, '
'regulatory bodies, and credit agencies. Legal '
'firms (e.g., Shamis & Gentile P.A.) advising '
'victims on compensation claims.',
'title': 'Hamilton Construction Company Data Breach',
'type': 'Data Breach'}