Construction has been called the top target for cyberattacks, but that statement needs a precise qualifier. Construction ranked first for ransomware in a NordLocker analysis of 1,200 companies across 35 industries, reported by Construction Dive on December 1, 2021. A January 2024 trade report said a later NordLocker study placed construction first in two of the preceding three years and counted construction firms as 12% of attacks among 18 surveyed industries. Those are historical, study-specific findings—not proof that construction is currently the leading target for every type of cybercrime worldwide.
The underlying risk is nevertheless substantial. Projects connect owners, general contractors, subcontractors, designers, suppliers and consultants through shared software, email, cloud storage and payment processes. That network can expose building plans, bid information, financial records, personal data and operational systems. A successful intrusion can stop a job, redirect a payment or release sensitive designs. The practical response is layered preparation: strong identity controls, verified payment procedures, resilient backups, trained employees, supplier oversight and an incident plan that can be used under pressure.
As an Amazon Associate I earn from qualifying purchases.
What the “top target” claim actually shows
Cybersecurity rankings are meaningful only when their scope is clear. “Attack” can mean a ransomware event, a reported incident, an organization appearing in a dataset or a respondent’s perception of risk. The figures below measure different things and should not be combined into one current attack rate.
| Finding | What was measured | How to interpret it |
|---|---|---|
| Construction ranked No. 1 | NordLocker analysis of 1,200 companies in 35 industries; ransomware; reported by Construction Dive on Dec. 1, 2021 | A historical sample-based ranking for ransomware, not all cyberattacks or all construction companies |
| 12% of attacks | NordLocker study reported by Daily Commercial News/ConstructConnect in January 2024; 18 industries | A reported share within that study’s dataset, not a global industry-wide rate |
| 75% perceived sector issues | Accuracy, Freshfields Bruckhaus Deringer and NYU Abu Dhabi survey conducted October–December 2022 | Respondents’ perception of cybersecurity problems, not the percentage of firms attacked |
| 187 started; 52 completed | Participants in the Middle East-focused construction cybercrime survey | A limited regional survey whose results cannot establish a worldwide prevalence figure |
Incident prevalence is difficult to calculate because companies may not report breaches, may classify them differently or may discover them long after the initial compromise. A ranking can show that construction appeared frequently in a particular dataset while saying little about an individual builder’s probability of attack today.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why construction presents an attractive attack surface
One project, many connected organizations
A typical project may involve a developer, architect, engineer, general contractor, specialty trades, equipment providers, material suppliers, inspectors and lenders. Participants exchange drawings, schedules, change orders, invoices and credentials. Access granted for a legitimate business purpose can become an entry route if a partner account is phished or poorly secured. Lower-tier suppliers may still handle sensitive plans and designs, while having fewer staff or resources for security controls.
High-value information is distributed across systems
Computer-aided design and building information modeling files can reveal structural layouts, security features, mechanical systems and future facilities. Estimating databases contain bid assumptions and subcontractor pricing. Human-resources and payroll systems hold identity and banking data. Project-management platforms may include contracts, insurance certificates, safety records and private correspondence. An attacker does not need every system to cause harm; access to one heavily used repository can be enough to create leverage.
Deadlines make disruption expensive
Construction is schedule-driven. If a project-management system, document repository or field communication tool is unavailable, crews may lose the latest drawings, approvals or delivery instructions. Equipment can sit idle while a dispute is investigated. Even when no data is stolen, a day of delay can create cascading labor, rental and financing costs. Criminals understand that a company facing liquidated damages or a critical handover date may feel pressure to pay quickly.
Recommended Free Tools
Distributed jobsites and connected devices
Jobsites commonly use cameras, access-control equipment, asset-tracking tags, machine-control systems, tablets and wearables. Construction Dive and other industry reporting have identified connected-building systems and jobsite Internet of Things devices as practitioner concerns. Each device adds an account, software stack, network connection or physical access point that must be inventoried and maintained. Exposure varies widely by project; using a connected device does not by itself mean a company is compromised.
Smaller firms can be pivotal links
A small subcontractor may not be the ultimate target, yet it can possess a shared login, remote-access credential or file-transfer permission for a much larger project. Limited budgets, informal account sharing and inconsistent patching can make that relationship attractive to attackers. Security therefore has to cover the project ecosystem, not only the largest company on the contract.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The attack methods construction teams should plan for
Phishing and business email compromise
An attacker may impersonate a project executive, supplier or title company and request a wire transfer, updated banking details or an urgent document review. Messages often exploit real project names, invoice numbers and deadlines gathered from public sources or compromised mailboxes. A reply to a familiar thread is not proof of authenticity if the sender’s account has been taken over.
Ransomware
Ransomware can encrypt shared drives, cloud-synchronized folders, estimating systems or field servers and then demand payment for restoration or for a promise not to publish stolen files. Restoration may be possible without paying, but only if backups are complete, protected from the attacker and tested. Paying does not guarantee decryption, confidentiality or a rapid return to work.
Data theft and extortion
Criminals may copy drawings, employee records, contracts, credentials or bid data without immediately disrupting systems. They can later threaten disclosure, use the information for fraud or sell access to another group. Confidentiality obligations may apply even when operations continue normally.
Compromise through a supplier or software account
Attackers may enter through a subcontractor’s email, a shared collaboration platform, remote desktop service or an outdated device at a jobsite. A trusted connection can bypass some perimeter defenses, which is why supplier access needs the same identity and logging discipline as internal access.
What a successful attack can change on a live project
- Design control: Crews may work from obsolete drawings if the authoritative model or document-management system is unavailable.
- Procurement: A fraudulent change to supplier banking details can redirect a legitimate payment.
- Scheduling: Missing delivery dates, inspection records or approvals can move critical-path activities.
- Safety: Temporary loss of access to plans, contact lists or monitoring systems can complicate safe decision-making.
- Commercial obligations: Owners, lenders and insurers may require prompt notification, evidence preservation and documented recovery actions.
- Reputation and future bids: A client may question whether a contractor can protect confidential designs and personal information.
These effects are not inevitable, and they do not occur in every incident. They explain why construction leaders should treat cybersecurity as an operational and contractual risk rather than only an IT issue.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
A practical defense plan for contractors and project owners
1. Map critical assets and dependencies
List the systems that would stop work if unavailable: email, identity services, project-management software, drawing repositories, accounting, payroll, access control and machine systems. Record who administers each service, which suppliers connect to it, where backups reside and how the project would operate manually for 24 hours.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors2. Require multifactor authentication
Enable MFA first for email, administrator accounts, remote access, finance systems and cloud collaboration. Prefer phishing-resistant methods where the account supports them. A hardware security key is one optional physical authenticator; compatibility depends on the specific account and system. MFA reduces the value of a stolen password but does not stop every form of social engineering.
3. Protect administrator credentials
Use separate administrator and everyday accounts, long unique passwords and a password manager approved by the organization. Remove dormant accounts promptly, prohibit shared administrator logins and review privileged access when a project ends or an employee changes roles. Log administrative activity so an investigation can distinguish normal maintenance from misuse.
4. Make backups recoverable, not merely present
Maintain backups for essential files and databases using a design that prevents an intruder who compromises production credentials from deleting every copy. Keep at least one backup isolated or otherwise protected from routine network access. Test restoration of a representative drawing set, accounting record and project database on a schedule; a backup that has never been restored is an assumption, not a recovery plan.
5. Train people around real project workflows
Short, recurring training should cover invoice changes, urgent wire requests, cloud-sharing invitations, mobile-device loss and suspicious MFA prompts. Employees need a simple reporting channel and permission to pause a transaction without being penalized for caution. Bobbi Bookstaver, director of information security at Shawmut Design and Construction, described the approach this way: “With no singular solution to prevent an attack, the defense strategy should pair technology with a robust communication campaign to drive awareness and education and provide the tools to act swiftly in the event of an attack.”
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
6. Verify payment instructions independently
When a supplier, owner or executive requests a new bank account or an urgent transfer, confirm the change using a known telephone number or an established contact—not the number or link in the message. Require a second person to review high-value or unusual payments. Preserve the approval record so the project can reconstruct what happened if fraud is later alleged.
7. Control supplier and subcontractor access
Put minimum security expectations in contracts: MFA for shared services, prompt notification of incidents, named user accounts, timely removal of access and cooperation with investigations. Give each partner only the folders and systems required for its scope. Review inactive external accounts at milestones such as design completion, substantial completion and final payment.
8. Segment and maintain jobsite technology
Separate cameras, building controls, machine systems and guest Wi-Fi from administrative networks where practical. Change default credentials, apply supported firmware updates, disable unused services and document who can reach each device remotely. If a device cannot be patched or monitored, isolate it and plan its replacement rather than allowing it unrestricted access.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to prepare for an incident before it happens
- Name the incident team: Include operations, IT, legal, finance, communications, insurance and the project executive. Assign an alternate for each role.
- Define the first-hour actions: Identify who can disable accounts, isolate systems, preserve logs and contact outside responders. Do not let well-intentioned staff wipe or reboot suspected evidence without guidance.
- Keep offline contact details: Store emergency numbers for executives, banks, insurers, key suppliers and response specialists outside the systems that could be encrypted.
- Set decision rules: Document who may approve shutdowns, customer notifications, regulatory reports, ransom discussions and restoration priorities.
- Exercise the plan: Walk through a scenario involving a fraudulent payment and another involving encrypted project files. Record gaps, owners and due dates for fixes.
If an incident is suspected, stop sending sensitive information through the affected account, call the bank immediately about disputed payments, isolate compromised devices when safe to do so and preserve relevant messages, logs and invoices. Use a known channel to coordinate. Notify contractual or legal contacts according to the project agreement and applicable law. Recovery should proceed from verified clean systems, with passwords and tokens rotated as part of containment.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Using NIST CSF 2.0 without treating it as a certificate
NIST’s Cybersecurity Framework 2.0 is a general way to organize risk management. A construction company can use its functions—Govern, Identify, Protect, Detect, Respond and Recover—to assign owners and measure progress. For example, “Identify” can include a register of subcontractor connections and critical project data; “Protect” can include MFA and tested backups; “Detect” can include alerts for impossible logins or unusual file downloads; “Respond” can include the incident team and communications plan; and “Recover” can include restoration priorities and lessons learned.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
The framework is not construction-specific certification and does not prove that a company is secure. Its value is consistency: executives, project managers, IT staff and suppliers can use the same vocabulary to discuss risk, investment and accountability.
Questions construction leaders commonly ask
Does the 2021 ranking mean construction is still the most attacked industry?
No. It means construction ranked first for ransomware in the particular NordLocker analysis of 1,200 companies across 35 industries reported in 2021. The January 2024 report describes another historical NordLocker finding, but neither establishes a current global ranking for every form of cyberattack.
Is the 12% figure the percentage of construction companies that were attacked?
No. It was the share of attacks attributed to construction firms within a study covering 18 industries. The story does not provide a global denominator for all construction companies.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →What does the 75% survey figure tell me?
It reports that 75% of respondents in a limited Middle East-focused survey felt there were cybersecurity issues in construction. Because 187 people began the survey and 52 completed every section, and because the question measured perception, the result is not an attack rate for the sector.
Can MFA and backups prevent a breach?
They reduce the likelihood or impact of common incidents but cannot guarantee safety. Attackers can exploit unprotected accounts, authorized access, vulnerable devices or human decisions that bypass technical controls. Layered safeguards and practiced response are more reliable than any single product.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
