AECOM Lawsuit: An Unconfirmed Hack, No Class Action, No Settlement
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
The reason people are searching for an AECOM lawsuit right now is a hacking claim. On September 17, 2026 two ransomware groups listed AECOM, the Dallas-based engineering and infrastructure firm, on their leak sites. As of October 10, 2026 AECOM has not publicly confirmed a breach, no AECOM class action over it has been found, and there is no AECOM settlement, no claim form and no deadline.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What the Hackers Claim
On September 17, 2026 the ransomware group Metaencryptor listed AECOM on its leak site and claimed responsibility for an attack. The group claims it encrypted “critical data” and threatened to publish it if negotiations did not start within 7 days. On the same date a second group, Brain Cipher, listed aecom.com and claimed to hold 670 GB of data.
These are claims by the attackers, not established facts. The listings name no number of affected people and no categories of data. One tracker flagged the AECOM entry as a possible duplicate. Monitoring services caution that leak-site posts mix real compromises with recycled data, exaggerated volumes and false claims. As of October 10, 2026 no regulator, breach-notification service or independent researcher had verified this incident.
Case Details
No court case has been found over the September 2026 claims. A lawyer-referral site (ClassAction.org) says attorneys are looking into whether a class action can be filed; an investigation is a call for clients, not a lawsuit.
Other AECOM litigation that shows up in searches is unrelated to consumers:
Employment: Psenicska v. AECOM, et al., No. 2:26-cv-02304, filed April 9, 2026 in the U.S. District Court for the Eastern District of Pennsylvania. A former marketing manager alleges gender and age discrimination and retaliation; there is no final determination.
Contract dispute: On August 14, 2026 the Tenth Circuit (No. 25-1140) affirmed a $5.259 million judgment for AECOM Technical Services against the Flatiron | AECOM joint venture over the C-470 express lanes near Denver (D. Colo. No. 1:19-CV-02811).
Whistleblower: On March 19, 2026 the Second Circuit, in a nonprecedential summary order, affirmed that a former employee had not shown materiality in his False Claims Act suit over an Army support contract in Afghanistan.
Status: Unconfirmed Claims, No Case, No Money
Two things would change that. First, AECOM confirming an incident and mailing notices to the people affected. Second, a complaint actually being filed in court. Until then, the leak-site posts are the only public record, and they come from the people trying to extort the company.
Who Could Be Affected
Nobody knows yet. AECOM is a professional-services firm, not a consumer brand, so the people most likely to hold records with it are current and former employees, job applicants, and business or government clients on its projects. The listings themselves give no scale and no data types.
The practical test is your mail. If AECOM confirms an incident involving personal information, affected people are notified directly by the company. A notice letter is your proof; keep it and the envelope. You do not have to sign up anywhere to be part of a future class action.
Is There Any Money?
For context only: the best-known AECOM settlement paid the government, not consumers. On October 24, 2023 AECOM agreed to pay $11.8 million to resolve False Claims Act allegations over Hurricane Katrina recovery work for FEMA, of which $2.4 million went to the whistleblower. AECOM denied liability.
AECOM Lawsuit Timeline
- 1
October 24, 2023 — Katrina False Claims Settlement
AECOM agrees to pay $11.8 million to resolve allegations over FEMA worksheets after Hurricane Katrina. It denies liability. No consumer payments.
- 2
March 19, 2026 — Whistleblower Loses Appeal
The Second Circuit affirms that a former employee did not show materiality in his Afghanistan Army-contract False Claims Act suit.
- 3
April 9, 2026 — Employment Suit Filed
A former marketing manager sues in the Eastern District of Pennsylvania (No. 2:26-cv-02304), alleging discrimination and retaliation.
- 4
August 14, 2026 — Tenth Circuit Rules for AECOM Unit
The appeals court affirms a $5.259 million judgment for AECOM Technical Services in the C-470 express-lanes dispute.
- 5
September 17, 2026 — Two Ransomware Groups List AECOM
Metaencryptor claims an attack; Brain Cipher claims 670 GB of data. AECOM has not publicly confirmed either claim.
- 6
October 10, 2026 — No Breach Case, No Settlement
No confirmed breach, no filed class action, no fund, no claim form and no deadline.
Three Things to Watch For
An unconfirmed hack at a large employer, plus ads about an “AECOM class action,” is the setup imposters look for:
“AECOM data breach settlement” claim pages
There is no settlement and no claims portal. A site asking for your Social Security number or bank details to “secure your payment” is collecting data, not filing a claim.
Fake HR or payroll emails
If staff data was taken, attackers can write convincing messages that look like they come from AECOM HR or payroll and ask you to “verify” direct deposit or log in. Go to the company portal yourself; do not click the link.
Messages from the hackers themselves
Extortion groups sometimes contact employees or clients directly, threatening to publish their files. Do not pay or reply. Report the message to AECOM and to the FBI's IC3.
AECOM Lawsuit — Questions People Actually Ask
Is there an AECOM class action over a data breach?
Not that we could find as of October 10, 2026. A lawyer-referral site has said attorneys are looking into a possible case after the September 17, 2026 leak-site listings, but an investigation is not a lawsuit, and AECOM has not confirmed a breach.
Is there an AECOM settlement I can claim from?
No. There is no AECOM settlement, fund, administrator, claim form or deadline for consumers or employees. The $11.8 million Katrina settlement from 2023 was paid to the U.S. government, not to individuals.
What did the hackers claim to take?
Metaencryptor claims it encrypted AECOM data and threatened to leak it. Brain Cipher claims 670 GB. Neither listing names data types or a number of affected people, and neither has been independently verified.
How do I know if my information was involved?
You cannot tell from the leak-site posts. If AECOM confirms an incident involving personal information, it notifies affected people directly. Until then, there is no list to check.
Is AECOM being sold?
No. On February 9, 2026 AECOM said it had completed a review of strategic alternatives for its Construction Management business and will continue to own and operate it. AECOM remains a listed company (NYSE: ACM). This has nothing to do with any lawsuit.
Is AECOM a US company?
Yes. AECOM is a Fortune 500 firm listed on the New York Stock Exchange, issuing its releases from Dallas. It reported revenue of $16.1 billion in fiscal year 2025 and works in water, environment, energy, transportation and buildings.
What other lawsuits involve AECOM?
Mostly business and government disputes. In its filing for the quarter ended June 30, 2026, AECOM said it collected $51.1 million to fully resolve a Montana refinery dispute. AECOM also entered into a settlement agreement in July 2026 resolving its Department of Energy claims, which will result in a $58.5 million payment to AECOM, plus the employment and contract cases above. None pays consumers.
What is worth doing right now?
If you work or worked for AECOM, watch for HR or payroll messages asking you to log in or change bank details. Consider a free credit freeze at all three bureaus. Keep any official notice letter if one arrives.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Open Class Action Settlements
Settlements with claim forms you can file today
Data Breach Settlement Calculator
What breach settlements have actually paid per person
Settlement Payout Calculator
Estimate a per-person payout from fund size and claim rate
ABC Supply Data Breach Lawsuit
Another building-industry breach and where its case stands