WBF Construction Data Breach

WBF Construction, a US-based construction company, has been identified as a victim by the AiLock ransomware group. The listing was published on July 14, 2026, and detected by SOCRadar’s Dark Web Monitoring service. This incident poses an immediate operational risk to WBF Construction, as disruptions to systems and data can halt ongoing projects and associated revenue streams. The targeting of a US construction firm aligns with AiLock’s recent trend of focusing on US-based entities, although construction is not its primary sector. AiLock has claimed 15 other victims in the 60 days preceding this listing. While its main focus has been the healthcare sector, it has also targeted consumer services and business services. The majority of its victims are located in the United States, with isolated cases in Mexico and Italy. Construction companies have not been a frequent target, but recent US-based victims in other sectors include Richmont Graduate University, Restorative Therapies, Inc., Design Engineering & Consulting, and Jazz Hipster.

A review of SOCRadar’s stealer-log telemetry for the domain wbfconstruction[.]com did not yield any relevant records within the queried data sample. This null result does not confirm the absence of compromised credentials, as they might exist under alternate corporate domains, personal email aliases, or in data feeds not included in the sample. Ransomware groups like AiLock commonly acquire stolen credentials from underground marketplaces to gain initial access, often exploiting compromised logins for services like Microsoft 365 or VPNs, before deploying ransomware. This access method remains a potential vector for attack, regardless of the current query results.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.