The Turner Construction breach: payroll files, and what to do about it

Somebody had access to systems at Turner Construction, the largest general contractor in the United States, between 2 and 15 July 2026. Turner established on 27 July that files containing personal information had been opened without authorisation, and spent the following three weeks working out whose. A crew calling itself Payouts King posted about an unnamed victim on 24 July and named Turner on 11 August. The filings with the attorneys general of California and Vermont went in on 18 August, written notices to affected people started going out on or about the same day, and the story reached the trade and legal press between 19 and 21 August. Turner has published no separate public statement beyond the notice and a short line declining to discuss the attackers’ claims.

A contractor’s customers are developers, hospitals, airports and public agencies, and none of them hand over a Social Security number to get a building put up. The individuals in a company like this are the people who work for it, so the file that was taken is payroll and human-resources paperwork rather than a customer database. That changes who is exposed and how they find out. There is no account to log into, no place to type your name and see whether you are on a list, and no way to check yourself. The letter is the mechanism, it goes to the address Turner last had for you, and former staff are the group most likely to miss it.

The notification lists Social Security numbers for US personnel and Social Insurance numbers for Canadian personnel, dates of birth, home addresses, salary information and the bank account details used for direct deposit, with passport numbers possibly present in some files. Set that beside the average breach notice, which stops at a name and an email address. Everything here is permanent or slow to change: a Social Security number is issued once, a date of birth never moves, and while a bank account can be closed it is not something you do on a Tuesday afternoon. What is missing is equally worth noting. There are no passwords in this set and nothing to reset, so the account-security routine that follows a normal breach does not apply.

Most breach advice is generic because most breaches are. This one is specific enough to answer field by field. Because a Social Security number came out, freeze your credit file at Equifax, Experian and TransUnion, each separately and free, which blocks a new account rather than reporting one after it opens. Because the direct deposit account number came out, tell your bank the details are circulating and ask what it can add to the account, and ask payroll to verify any change of deposit instructions through a channel that is not email. Because your salary and Social Security number are now in the same file, request an Identity Protection PIN from the IRS before the filing season opens, which stops a return being filed in your name using income figures that look right.

Enrol in the identity protection Turner is paying for, using the code printed on your letter. Five years is a longer offer than most companies make, and the deadline on the notice is 18 November 2026, after which it cannot be activated. Check your Social Security earnings record for employment you did not do, which is where somebody using your number to work shows up. Read your bank statements rather than filing them, because a small test transaction is often the first sign an account is being probed. And keep the letter along with the date it arrived, since anything that comes of this later is far easier to pursue with the paperwork in hand. Our guide to breach notification letters goes through what a real one contains, line by line.

Anyone holding this file can open a conversation with your full name, your address, your date of birth, where you work and what you are paid. That is more than a bank asks before it believes you are you, and it is why the messages that follow a payroll breach tend to work. Expect calls about the breach itself, offers to “verify your enrolment” in the monitoring, and emails about a payroll or tax problem that quotes a real figure at you. Accuracy is the trap here, because most people check whether a message knows them rather than how it reached them. Assume every detail in that list is known, and verify by hanging up and calling a number you already had.

Within a few days of the disclosure, law firms were publishing investigations and sites were collecting names of affected people. That stage is worth understanding before you hand anything over. A firm announcing an investigation is looking for clients; there is no certified class, no court has approved anything, and no money exists to be claimed. If a case is filed and eventually settles, notice comes from a court-appointed administrator, arrives by post and costs nothing to act on, and that process runs for years. Our list of settlements currently taking claims is checked against the official administrator sites, so you can see what the real stage looks like.

The credit monitoring runs out in five years and the file at Turner gets closed long before that. What does not change is the home address and phone number that made the stolen record usable in the first place, both of which are published and sold by people-search and data-broker sites regardless of who gets breached next. Taking those listings down is the one step here with an effect that outlasts the news, and it needs repeating rather than doing once, because brokers rebuild profiles from public records within weeks. For the general version of the response, our post-breach guide covers it in seven steps.