Twenty years ago, a construction company’s most sensitive information lived in a trailer. Blueprints sat in flat files, bids went out by fax, and the payroll binder was locked in a cabinet. Today that same information lives in project management software, cloud-stored drawings, subcontractor bid portals and a half-dozen personal phones belonging to superintendents who were hired to run concrete, not manage credentials. The work changed faster than the security budget did, and attackers have noticed.
Think about what moves through a typical mid-sized general contractor in a single week. Bid packages go out to a dozen subs. Change orders get approved from a phone in the parking lot. Pay applications, lien waivers, certified payroll and insurance certificates bounce between the office, the owner’s rep and a supplier’s accounting team. Nearly every one of those handoffs is digital now, and most of them run through email.
Construction Has Become a Top Ransomware Target
An industry cyber exposure analysis from insurer Howden found that construction and engineering made up 11.4 percent of all publicly reported ransomware victims in a single month in late 2025, the highest share of any sector tracked. UK national crime data shows construction is now attacked more often than any other industry by volume of incidents. The same analysis put the average disruption from one ransomware attack at 24 days for a construction business and described business email compromise losses of £150,000 or more as routine on major sites. Construction firms also reported the lowest cyber-preparedness confidence of nine surveyed sectors, at 74 percent (Howden, Cyber exposure in construction).
Those numbers reflect something specific about how construction makes money. Revenue is tied to schedules, retainage and penalty clauses. When the scheduling system, the estimating software or the shared drive holding stamped drawings goes dark, crews still show up and the clock keeps running. Ransomware groups price that pressure into their demands. A firm facing liquidated damages for a late turnover is far more likely to pay quickly than a business that can afford to wait out a three-week recovery.
Why Contractors Are an Easy Target
Project teams are spread across job sites with spotty connectivity, which pushes people toward whatever app or personal device gets the job done fastest. Nobody is being careless on purpose. They’re trying to keep a pour on schedule, and the approved tool doesn’t load on the cellular signal at the far end of the site.
Payment chains are the bigger problem. General contractors, subcontractors and suppliers constantly exchange invoices and wire instructions, and that multi-party handoff is exactly what business email compromise is built to exploit. Here’s how it usually plays out. A supplier’s email account gets compromised. The attacker quietly reads the thread for weeks, learns when the next large draw is due, and then sends a well-timed note: the supplier has changed banks, please update the wire details before Friday. The message comes from the real supplier’s real address, references the real project, and lands in front of a project accountant who processes dozens of these a month. Nothing about it looks wrong, and by the time the real supplier calls asking where their payment went, the money is gone.
Bid documents, schedules and site plans are also valuable enough to ransom, yet they’re rarely protected the way a law firm protects client files. And construction depends heavily on seasonal labor, sub crews and project-based hires. Accounts get created fast when a job kicks off and are rarely cleaned up when it wraps. A foreman who left eight months ago may still have a working login to the project management platform, and nobody would know unless someone went looking.
The Site Trailer Problem
Plenty of firms still keep a small server or network storage box in a trailer or back office so drawings and photos are available when the internet connection drops. Those devices are usually set up once by whoever was handy and never updated again. They sit on networks with a shared Wi-Fi password half the subcontractors know. When ransomware lands, that box is often the first thing encrypted and the last thing anyone thought to back up.
The same goes for field tablets. A shared iPad passed between crew leads, logged into email and the project platform with no passcode, is a convenient tool on a busy day and a serious liability the day it’s left in an unlocked truck.
What Actually Closes the Gap
None of this requires a construction firm to become a different kind of business. It requires the same fundamentals every industry needs, applied to how construction actually operates:
- Multi-factor authentication on email and project management tools, since that’s where most of these losses begin
- A written wire verification rule: any change to payment instructions gets confirmed by phone, using a number already on file, never by replying to the same email thread
- Offboarding tied to project closeout, so accounts for subs, temps and departed staff are removed when the job ends rather than whenever someone remembers
- Managed field devices with passcodes and remote wipe, so a lost tablet is an inconvenience instead of an incident
- Off-site, tested backups for project data that don’t depend on a single laptop or a trailer server
Each item is modest on its own. Together they shut the doors attackers use most often against contractors.
Build It Into Project Startup
The most effective habit we see is treating security as a line on the project startup checklist, right alongside insurance certificates and the site safety plan. When a job kicks off, accounts are created with exactly the access each person needs. When it closes, they’re removed. Wire verification procedures go to every sub and supplier in writing on day one, so nobody is surprised or offended when the accounting team calls to confirm a bank change later.
Framing it this way also makes it easier to sell internally. Field leaders already understand that a safety plan protects the job. A security checklist does the same thing for the schedule and the cash flow.
Construction Cybersecurity Questions
Why is construction a target for ransomware?
Construction revenue depends on deadlines and penalty clauses, so downtime is expensive. Attackers know a contractor facing delays is more likely to pay quickly.
How does wire fraud happen in construction?
Attackers compromise a supplier’s or subcontractor’s email, watch the payment threads, then send altered bank details right before a large draw. Confirming every change by phone, using a number already on file, stops most of these attempts.
What’s the first security step for a small contractor?
Turn on multi-factor authentication for email and project management tools, then adopt a written rule that all payment changes are verified by phone.
The Takeaway
Your project data is now as valuable as the equipment in your yard, and a lot easier to steal. The firms that hold up best aren’t the ones with the biggest security budgets. They’re the ones that decided ahead of time how payments get verified, who has access to what, and how they’d keep crews working if the office went dark. Before the end of the month, ask three questions: Who can approve a change to wire instructions, and how do they verify it? How many active accounts belong to people no longer on your payroll or your projects? If your main server went down tomorrow, how long until a superintendent could pull current drawings?
Cloud9 Tech Solutions builds these protections around how construction businesses really work, from site-to-office IT support to the security stack that protects project data whether it’s in the cloud or on a phone in someone’s truck.
If your project data is spread across more apps and devices than you can list from memory, that’s worth a closer look before an attacker finds the gap first. Schedule a free security assessment with Cloud9.