Skip to content

Search Ransomware Intelligence

Jump to a group, country, industry or search victims.

Listed on a ransomware leak site

Balfour Beatty

balfourbeatty.com

Balfour Beatty was listed on the Coinbase Cartel and Radiant and INC Ransom leak site on Oct 12, 2025. Brandefense has recorded 3 separate claims against it. Information as of Oct 19, 2026.

Country: United KingdomIndustry: Construction
Updated continuously · figures as of Oct 19, 2026
Claimed by
Coinbase Cartel, Radiant, INC Ransom
First listed
Oct 12, 2025
Claims recorded
3

3 Leak-Site Claims.

Coinbase CartelConfirmed claim
Posted on the leak site
Apr 8, 2026
Collected by Brandefense
Apr 8, 2026
Data claimed
Not stated
Leak-site post text, written by the group
Balfour Beatty is a leading international infrastructure group headquartered in the United Kingdom. The company operates in the construction, engineering, and infrastructure services industry, delivering projects across transportation, power, buildings, and civil engineering sectors. It works across the UK, United States, and other international markets, serving government, public sector, and private clients on major infrastructure and construction programs.
RadiantConfirmed claim
Posted on the leak site
Oct 12, 2025
Collected by Brandefense
Oct 12, 2025
Data claimed
Not stated
Leak-site post text, written by the group
Unknown. You will be contacted shortly. 3 Days for contact or else we will begin our process.
INC RansomConfirmed claim
Posted on the leak site
Oct 12, 2025
Collected by Brandefense
Oct 12, 2025
Data claimed
Not stated
Leak-site post text, written by the group
Balfour Beatty US, founded in 1933 and headquartered in Dallas, Texas, is a commercial construction company that offers services for construction management, general contracting, cost consulting, and design-building.

Get alerted the moment your company or a supplier is posted on a leak site.

Alert me
Other confirmed victims claimed by the same group
VictimClaimed byCountryIndustryData claimedPosted
Westwing Group SE
westwing.com
Coinbase CartelDEGermanyRetailNot stated
Integrated Health Systems
integratedhealthstack.com
Coinbase CartelUSUnited StatesTechnologyNot stated
RXPE Group
rxpe.com
Coinbase CartelCNChinaEnergy and UtilitiesNot stated
Tower Insurance
tower.co.nz
Coinbase CartelNZNew ZealandInsuranceNot stated
Flecha Bus
flechabus.com.ar
Coinbase CartelARArgentinaTransportation and LogisticsNot stated
OTEIS Conseil & Ingénierie
oteis.fr
Coinbase CartelFRFranceConsultingNot stated
Other confirmed victims in the same industry
VictimClaimed byCountryIndustryData claimedPosted
American Campus
americancampus.com
HelixUSUnited StatesConstructionNot stated
mckenneys
mckenneys.com
Iah6477USUnited StatesConstruction295.9 GB
Smith Douglas Homes
smithdouglas.com
HelixUSUnited StatesConstructionNot stated
Macfarlan Capital Partners
macfarlan.com
PearUSUnited StatesConstruction350 GB
Solar Communications International
rftransparent.com
PearUSUnited StatesConstruction1.4 TB
KD Corp
kdconstruction.us
QilinUSUnited StatesConstructionNot stated

Get Real-Time Alerts, IOC Feeds And Takedowns.

The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.

Figures as of Oct 19, 2026. Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.

Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.