The Threats Putting Projects at Risk

Ransomware: Holding Projects Hostage

Ransomware encrypts a company’s files and systems until a ransom is paid. Insurer QBE estimates that a single ransomware incident now causes an average of 24 days of downtime, and a separate industry survey found that more than three-quarters of construction firms can’t tolerate even five days without access to project documentation before operations suffer severe damage.

A September 2025 resurgence in ransomware activity made construction and engineering the most heavily hit sector of any industry tracked, and most attacks that year started with phishing emails.

Business Email Compromise and Wire Fraud

This is the threat most likely to hit a project’s bank account directly, and it’s the one currently costing the industry the most money. A typical scheme starts when a contractor’s, subcontractor’s, or owner’s email account is compromised or convincingly spoofed. The attacker then sends a routine-looking message, often timed to coincide with an actual draw request or invoice, asking that payment be redirected to a “new” bank account.

Between August 2023 and July 2024, nearly 500 construction organizations turned up on dark-web data-leak sites, a jump of more than 30% from the prior year. Business email compromise scams tied to construction accounted for over $1.2 billion in losses during that period. Nationally, the FBI’s Internet Crime Complaint Center logged $2.77 billion in business email compromise losses across more than 21,000 reported incidents in 2024.

These schemes can be remarkably simple: in one case, a scammer changed a single letter in a general contractor’s email address to divert nearly $800,000 from a church construction project.

Connected Jobsite Equipment and IoT/OT Vulnerabilities

Modern jobsites run on connected technology: GPS- and LiDAR-guided machinery, telematics that track fleets in real time, environmental and safety sensors, access-control systems, surveillance cameras, and a growing layer of AI-driven analytics that flags hazards or predicts equipment failure.

Although connectivity improves safety and productivity, it also expands the attack surface. A compromised sensor or control unit could feed false location data, interfere with a collision-avoidance system, or simply serve as a foothold an attacker uses to move deeper into the broader network.

Unlike office IT, jobsite equipment is often deployed with default credentials, infrequent firmware updates, and no segmentation from other systems, which is part of why malware activity aimed specifically at construction IoT has spiked so sharply.

Data Breaches and Intellectual Property Theft

Beyond ransom and fraud, attackers increasingly go after the data itself: BIM models, engineering specifications, project schedules, bid pricing, and proprietary construction methods.

Industry forecasts for 2026 point to project-critical information theft as a growing category of attack, separate from traditional ransomware. The damage isn’t always immediate or obvious. A stolen bid model can erode a competitive advantage, and a publicized breach can carry a longer reputational cost: firms known for a data breach risk being disqualified from bidding on high-security work such as airports, defense facilities, or other government-bonded projects.

Supply Chain and Subcontractor Risk

Threat-intelligence research has identified phishing as the leading way attackers gain initial access to construction networks and has tied the sector’s vulnerability directly to its heavy reliance on subcontractors and vendors operating under tight, high-pressure payment schedules. Attackers also target the software and equipment vendors that serve multiple construction firms at once, since a single compromised vendor can open a door into many projects simultaneously.

Insider Threats and Human Error

Not every incident involves a sophisticated outside attacker. A misconfigured cloud folder shared too broadly, a reused password, a lost laptop or tablet left in a site trailer, or a departing subcontractor whose system access was never revoked can all create the same exposure as a deliberate attack. With large numbers of temporary workers, subcontractors, and vendors cycling through system access over the life of a project, this kind of human error is common and often goes unnoticed until it’s exploited.