Erickson Companies, LLC data breach

What we know

Erickson Companies, LLC operates within the construction, development, and heavy industrial services sector, functioning as an integrated enterprise that manages large-scale commercial building projects, real estate assets, and complex supply chains. Because of the nature of its operations, Erickson maintains extensive personal, financial, and confidential records for a vast workforce, sub-contractors, project partners, and private clients. This operational model requires the collection and retention of highly sensitive employment, payroll, and banking details, making the company a central repository for personally identifiable information (PII) and corporate intellectual property.

In 2025, Erickson Companies, LLC formally reported a significant data security incident to the Office of the Maryland Attorney General. While the full architecture of the cyberattack is still under investigation, breaches affecting heavy construction, engineering, and development entities typically involve sophisticated ransomware deployments, unauthorized entry into internal corporate networks, or third-party vendor compromises. Attackers frequently exploit vulnerabilities in legacy IT infrastructure, remote access tools, or corporate email environments to infiltrate systems, exfiltrate proprietary files, and disrupt operational workflows before demanding extortion.

The data compromised in this incident routinely includes core identifiers such as full names, dates of birth, Social Security numbers, banking and direct deposit account details, home addresses, and tax-related documents. The exposure of this information creates severe, multi-layered risks for affected individuals. Social Security numbers and dates of birth provide the exact foundation bad actors need to commit tax fraud, open fraudulent credit lines, or execute total identity theft. Furthermore, compromised payroll records and direct deposit information place victims at immediate risk of financial account takeover, unauthorized wire transfers, and severe disruptions to their personal financial stability.

As an entity handling sensitive employee and financial records, Erickson Companies, LLC is bound by rigorous legal obligations under state data protection statutes, common-law duties of care, and Section 5 of the Federal Trade Commission Act, which mandates reasonable and appropriate data security practices. Organizations in the construction and corporate development sectors have a fundamental duty to implement robust administrative, physical, and technical safeguards—including multi-factor authentication, endpoint detection and response tools, encryption, and regular network vulnerability assessments. The occurrence of a widespread data breach strongly indicates potential failures in maintaining these mandatory security standards, leaving confidential files vulnerable to unauthorized exfiltration.

Receiving a data breach notification letter from Erickson Companies, LLC is a formal admission by the company that your confidential personal information was compromised due to inadequate security protocols. Legally, this notification establishes the necessary standing to participate in a class action lawsuit aimed at holding the company accountable for its negligence. Affected individuals do not need to prove that they have already suffered actual financial loss or identity theft to seek legal recourse; the increased, imminent risk of future fraud is legally sufficient. Our firm evaluates these cases on a contingency fee basis, meaning you pay nothing out of pocket, and we only collect a fee if we successfully recover compensation on your behalf.

See every breach reported in Maryland or read what to do after a ransomware attack.