Ransomware victim disclosure
← All victimsLeighton
Claimed by worldleaks · listed 2 months ago
Status timeline
- Listed
Mar 27, 2026
- Data leaked
At a glance
- Group
- worldleaks
- Status
- Data leaked
- Country
- United Kingdom
- Sector
- Construction
- Listed on leak site
- Mar 27, 2026
About the victim
AI dossier — public-source company profileLeighton is a UK-based software development and digital transformation company headquartered in Newcastle, North East England. The company specialises in building custom software applications, automating business processes, and providing embedded technology experts to help organisations accelerate digital capabilities. It holds AWS Advanced Tier Partner status and employs over 100 AWS-certified professionals.
- Industry
- Software Development & Digital Transformation Services
- Employees
- 51-200
Attack summary
Severity: medium — Data is marked as published (data_published), indicating some form of confirmed disclosure, but the leak post provides no specifics on the nature, volume, or sensitivity of the data involved, and the threat actor's description of the victim is demonstrably inaccurate, reducing confidence in claimed impact.The worldleaks group claims a data disclosure against Leighton, with the status recorded as data_published. The leak post's description of a multinational construction company appears to be AI-generated and misidentifies the victim; no specific data types, exfiltration volumes, or encryption claims are stated in the post.
Data the group says was taken
AI dossier — extracted from the leak post- Unspecified published data
Original description
AI-summarised, not from the leak postLeighton is a multinational construction company, based in Australia, known for undertaking major construction, infrastructure, telecommunications and engineering works around the world. It was previously known as Leighton Contractors, prior to its rebranding as CIMIC Group in 2015. Some of its notable projects include large-scale building, infrastructure, and civil & mining projects globally.
Sources
Source
Indexed 2 months agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
