Kiewit Corporation Data Breach Exposes Sensitive Employee and Contractor Information
On August 26, 2026, national class action law firm Edelson Lechtzin LLP announced an investigation into a data breach at Kiewit Corporation, one of North America’s largest construction and engineering firms. The incident, disclosed by Kiewit, involved unauthorized access to an employee’s Microsoft 365 account, potentially compromising the personal data of current and former employees and independent contractors.
Timeline and Response
Kiewit detected the breach after identifying suspicious activity in an employee’s account. The company launched an internal investigation, engaged a third-party forensic firm, and notified law enforcement. Containment measures including a forced password reset and account disablement were implemented. By July 24, 2026, Kiewit completed its review of affected data and reported the incident to the Massachusetts Office of Consumer Affairs and Business Regulation on August 21, 2026. Affected individuals began receiving breach notifications shortly after.
Exposed Data
The breach may have exposed a range of sensitive information, varying by individual. Compromised data could include:
- Full names
- Addresses
- Dates of birth
- Social Security numbers
- Driver’s license or government-issued IDs
- Employment-related health information
Impact and Risks
The exposed data particularly Social Security numbers and financial identifiers elevates the risk of identity theft and financial fraud for affected individuals. The breach underscores vulnerabilities in corporate data protection, as organizations handling sensitive employee information are expected to implement robust security measures.
Edelson Lechtzin LLP is evaluating potential legal action on behalf of those impacted, though the investigation remains ongoing. Kiewit has not disclosed the total number of individuals affected.
Kiewit cybersecurity rating report: https://www.rankiteo.com/company/kiewit
"id": "KIE1787783299",
"linkid": "kiewit",
"type": "Breach",
"date": "7/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Current and former employees '
'and independent contractors',
'industry': 'Construction and Engineering',
'location': 'North America',
'name': 'Kiewit Corporation',
'size': 'Large',
'type': 'Corporation'}],
'attack_vector': 'Unauthorized access to Microsoft 365 account',
'customer_advisories': 'Breach notifications sent to affected individuals',
'data_breach': {'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Full names',
'Addresses',
'Dates of birth',
'Social Security numbers',
'Driver’s license or '
'government-issued IDs',
'Employment-related health '
'information']},
'date_detected': '2026-08-26',
'date_publicly_disclosed': '2026-08-26',
'description': 'Unauthorized access to an employee’s Microsoft 365 account at '
'Kiewit Corporation led to the potential compromise of '
'personal data of current and former employees and independent '
'contractors. The breach exposed sensitive information '
'including Social Security numbers, addresses, and '
'employment-related health data, raising risks of identity '
'theft and financial fraud.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'exposure of sensitive employee data',
'data_compromised': 'Sensitive personal and employment-related '
'information',
'identity_theft_risk': 'High',
'legal_liabilities': 'Potential class action investigation',
'systems_affected': 'Microsoft 365 account'},
'initial_access_broker': {'entry_point': 'Microsoft 365 account'},
'investigation_status': 'Ongoing',
'references': [{'source': 'Edelson Lechtzin LLP'}],
'regulatory_compliance': {'legal_actions': 'Class action investigation by '
'Edelson Lechtzin LLP',
'regulatory_notifications': ['Massachusetts Office '
'of Consumer Affairs '
'and Business '
'Regulation']},
'response': {'communication_strategy': 'Breach notifications sent to affected '
'individuals',
'containment_measures': ['Forced password reset',
'Account disablement'],
'incident_response_plan_activated': 'Yes',
'law_enforcement_notified': 'Yes',
'third_party_assistance': 'Third-party forensic firm engaged'},
'title': 'Kiewit Corporation Data Breach Exposes Sensitive Employee and '
'Contractor Information',
'type': 'Data Breach'}