.webp)
Construction Project Cyber Attack: Mid-build, construction drawing ransomware forced teams to revert to a 2-week old backup or pay the Bitcoin ransom
On one major construction project, 90% of the workforce was forced to stop what they were doing and go home. The construction drawings had been ransomwared.
Joe Gaspardone of Montgomery Technologies told the story at NexusCon 2025 in a session he called Tales from the Cyber Crypt: anonymized incidents pulled from 15 years of being called in, often first on site, when something goes wrong on a building's network. Most cybersecurity war stories come from casinos and retailers, but this one uniquely came from a construction job site.
The current construction drawings were being held hostage. The last usable backup was two weeks old, which meant every markup, revision, and coordination decision made on those drawings in the previous two weeks was gone. Teams restarted from stale documents while the project sat idle.
That's what made the Bitcoin ransom demand so tempting. "You're like, gosh, I really want those current construction drawings. It's only $4,800. Yeah, but can I trust it? So there's your decision point," Gaspardone said.
The team ate the loss instead of paying, and the project absorbed the consequence: five weeks added to the construction timeline. As Gaspardone put it, "five weeks is not something you already have," on a schedule that has usually burned through its extensions already.
It was never clear what allowed the breach to happen, but on a jobsite with dozens of trades looking to access the systems they need, the possibilities for an attacker are endless.
Register for the next Nexus Labs event.
Sign up for the newsletter to get 5 stories like this per week:
On one major construction project, 90% of the workforce was forced to stop what they were doing and go home. The construction drawings had been ransomwared.
Joe Gaspardone of Montgomery Technologies told the story at NexusCon 2025 in a session he called Tales from the Cyber Crypt: anonymized incidents pulled from 15 years of being called in, often first on site, when something goes wrong on a building's network. Most cybersecurity war stories come from casinos and retailers, but this one uniquely came from a construction job site.
The current construction drawings were being held hostage. The last usable backup was two weeks old, which meant every markup, revision, and coordination decision made on those drawings in the previous two weeks was gone. Teams restarted from stale documents while the project sat idle.
That's what made the Bitcoin ransom demand so tempting. "You're like, gosh, I really want those current construction drawings. It's only $4,800. Yeah, but can I trust it? So there's your decision point," Gaspardone said.
The team ate the loss instead of paying, and the project absorbed the consequence: five weeks added to the construction timeline. As Gaspardone put it, "five weeks is not something you already have," on a schedule that has usually burned through its extensions already.
It was never clear what allowed the breach to happen, but on a jobsite with dozens of trades looking to access the systems they need, the possibilities for an attacker are endless.
Register for the next Nexus Labs event.
Sign up for the newsletter to get 5 stories like this per week:
This is a great piece!
I agree.