Turner Construction data breach: employee pay and ID files accessed in July 2026

What happened at Turner Construction?

Turner found the activity, secured its systems, brought in outside cybersecurity experts and opened an investigation. The investigation put the unauthorized access at July 2 to 15, 2026. On July 27, 2026, Turner confirmed that files containing personal information had been accessed without authorization. The filing does not say how the intruders got in, whether files were copied out, or whether there was a ransom demand. It calls the matter ongoing and says the notice will be supplemented if significant new facts emerge.

California's record gives July 2, 2026 as the date of the breach. Turner notified federal law enforcement and says it is adding safeguards and training for its employees. The letters went out 22 days after the files were confirmed and 34 days after the access ended.

Date	What happened	Source
July 2 to 15, 2026	Unauthorized access to some Turner systems	Notice, California AG record
July 27, 2026	Turner confirms files with personal information were accessed	Notice
August 18, 2026	Letters sent; notice sent per Indiana; reported to Washington	Notice, Indiana and Washington records
August 21, 2026	Published by Texas	Texas AG list

What information was in the Turner files?

The notice lists the categories, and each person's files held one or more of them:

• name and home address;
• Social Security number for people in the United States, or Social Insurance Number for people in Canada;
• date of birth;
• salary;
• bank account information used for direct deposit;
• for a limited number of people, a passport number.

Salary and direct deposit details are payroll data, and the letter is signed by Turner's chief people officer, but the notice does not say whether everyone affected is a current or former employee. Washington lists name, Social Security number, financial and banking information, full date of birth and passport number. Texas marks name, address, Social Security number, financial information and date of birth.

How many people were affected by the Turner Construction breach?

Indiana's record gives the total: 70,256 people. Four states count their own residents, and California's count comes from Turner's own cover letter:

Record	People counted
Indiana attorney general, total	70,256
California residents (Turner's filing)	6,098
Texas residents	3,683
Washington residents	3,401
Indiana residents	846

Turner told California it wrote to approximately 6,098 California residents on or about August 18, 2026. Texas published its report on August 21, 2026, with notice by U.S. mail. The Washington ranking and the ranking of breaches affecting Texans compare these counts with other 2026 notices.

What is Turner offering?

Five years of IDShield identity monitoring, identity restoration and related support, at no cost. People must enrol to get it. Enrolment is at access.legalshield.com, where IDShield asks for a date of birth and Social Security number to verify identity. The plan monitors identifiers such as Social Security, passport and driver's licence numbers, bank accounts and logins. It assigns a licensed private investigator to restore an identity after theft. The cover letter to California describes the service as credit monitoring "through IDX and IDShield". The guide to credit-monitoring offers compares this five-year offer with others in this log.

Was my information in the Turner Construction data breach?

A letter from Turner Construction dated August 18, 2026, from a P.O. box in Suwanee, Georgia, means the review found your information in the files. The filing includes an English and a Spanish version of the letter. Questions go to the Turner Identity Protection Response Team at 1-866-688-9340 or TurnerIdentityProtection@tcco.com. A call center on 1-866-200-0984 takes calls Monday to Friday, 9 a.m. to 9 p.m. Eastern Time. Turner's written address is 66 Hudson Boulevard East, New York, NY 10001.

The letter asks people to review bank, credit card and retirement accounts, turn on account alerts and multi-factor authentication, and be wary of unexpected calls, texts or emails asking for personal details. With direct deposit details in the files, a request to change where pay is sent is one to check with the employer directly. The guide to letters from companies you never dealt with helps if you were not a Turner employee.

What the notice leaves open

• How the intruders got in, and whether files were copied out of Turner's systems.
• Who the 70,256 people are: employees, former employees, people at subcontractors or others.
• How many had a passport number in the files.
• How many Canadian residents were affected; the letter covers Social Insurance Numbers but no Canadian count is in these records.