Lydig Construction, Inc. data breach

What we know

Lydig Construction, Inc. operates as a prominent commercial general contractor and construction management firm, overseeing complex building projects across the Pacific Northwest and surrounding regions. Because of the vast scale of their operations, the company routinely collects, processes, and stores an extensive volume of highly sensitive personal and financial data. This information does not solely belong to corporate executives; it encompasses comprehensive employment records for project managers, field engineers, laborers, subcontractors, and administrative staff. To manage payroll, employee benefits, project compliance, and vendor relationships, Lydig Construction maintains centralized databases loaded with confidential personally identifiable information (PII).

In 2025, Lydig Construction, Inc. reported a significant data security incident to the Montana Attorney General, alerting state regulators and affected individuals that unauthorized parties had compromised their digital infrastructure. While specific technical forensics continue to emerge, data security incidents within the construction and contracting sector frequently involve sophisticated ransomware deployments, credential harvesting, or unauthorized intrusions into corporate networks and third-party vendor platforms. Construction firms are uniquely vulnerable to such attacks due to the decentralized nature of their work environments, which often rely on remote field communications, shared digital blueprints, and complex supply chain networks that can serve as vectors for malicious actors seeking to exfiltrate proprietary corporate files and personal records.

The breach exposed a wide array of sensitive data categories, each carrying severe risks for the affected workers and business partners. Exposed information typically includes full names, Social Security numbers, dates of birth, home addresses, banking and direct deposit details, wage and compensation records, and tax-related documentation. When Social Security numbers and banking details fall into the hands of cybercriminals, victims face an immediate and long-term threat of identity theft, fraudulent credit card applications, unauthorized loans, and tax refund fraud. Furthermore, compromised direct deposit details can lead to immediate financial account takeover, leaving hardworking individuals vulnerable to devastating monetary losses that require months or years to resolve.

Operating as an employer and corporate entity, Lydig Construction, Inc. had a profound legal and ethical duty to safeguard the private data entrusted to its care. Under state data protection laws and the general legal standards governing corporate negligence, companies that collect PII are obligated to implement reasonable security measures, such as multi-factor authentication, network segmentation, regular vulnerability assessments, and robust encryption protocols. The occurrence of a widespread data breach strongly suggests a failure in these foundational security protocols. Under established legal principles, organizations that fail to maintain adequate safeguards can be held legally accountable for the resulting exposure of confidential consumer and employee data.

Receiving a data breach notification letter from Lydig Construction, Inc. serves as formal legal acknowledgment that your personal information was compromised due to corporate security failures. Legally, this notification establishes the necessary standing to participate in a class action lawsuit aimed at holding the company accountable for failing to protect your privacy. Affected individuals do not need to prove that they have already suffered actual financial fraud to seek legal redress; the increased risk of future identity theft and the loss of privacy are recognized harms. Our firm investigates these data breach matters on a strict contingency fee basis, meaning you pay absolutely nothing out of pocket, and we only collect a fee if we successfully recover compensation on your behalf.

See every breach reported in Montana or read what to do after a ransomware attack.