lya Construtora Data Breach

lya Construtora, identified as a manufacturing company operating in the United States, has been listed as a victim by the RansomHouse ransomware group. The group published this information on their dark web portal on August 6, 2026, which was detected by SOCRadar’s Dark Web Monitoring service. While the company name suggests a focus on construction and building contracting, which involves significant operational data such as project documentation and supplier records, it was one of four RansomHouse entries published on that specific date. In the 60 days preceding this listing, RansomHouse claimed nine other victims. The group has predominantly targeted the government and defense, manufacturing, and financial services sectors, with a significant concentration of victims located in the United States, Panama, and Canada. Previous RansomHouse targets that share similarities with lya Construtora, such as being in the manufacturing or construction sectors or based in the United States, include Promepla, City of McMinnville OR, City of Beacon, and TECHVENTURES BANK S.A. Given the group’s typical focus on public sector and financial entities, the inclusion of a construction contractor may be part of a larger batch publication rather than a targeted shift in their usual pattern.

SOCRadar’s analysis of stealer-log telemetry related to initial access vectors returned no records for the queried domain in this particular data slice. It is crucial to note that the source dataset associated this victim with mcminnvilleoregon.gov, a domain belonging to another RansomHouse victim listed on the same day, rather than a domain plausibly owned by lya Construtora. Consequently, this finding provides no meaningful information regarding lya Construtora’s actual credential exposure and should not be interpreted as an indication that the organization is unaffected by risk. For ransomware groups like RansomHouse, the acquisition of credentials harvested by infostealers is a well-established method for initial access. Threat actors or initial access brokers often source active credential logs from underground marketplaces. They then validate these corporate credentials to gain access to systems such as Microsoft 365, VPNs, or remote-access portals, which are subsequently used to deploy ransomware. The absence of specific evidence in this query does not exclude this scenario, especially given that the query was not scoped to the victim’s own identified namespaces. Threat intelligence teams should consider continued monitoring and a properly scoped domain lookup as the necessary next steps, rather than viewing a null query result as a sign of exoneration.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.