Short answer
Architecture firms have appeared on ransomware leak sites throughout 2026, according to threat-intelligence trackers. The groups claim to have taken CAD files, BIM models, contracts, client data and employee records. These are unconfirmed claims from criminal groups, and the firms involved have not verified them. Design firms are attractive because they hold valuable files and often run small or outsourced IT setups. Coverage for a ransomware event varies by policy, so review the actual wording.
What ransomware leak sites are
Ransomware groups run websites where they list organizations they say they attacked. They post a firm’s name, a countdown and sometimes samples of stolen files. The goal is pressure. If the firm does not pay, the group threatens to publish the data.
This approach is often called double extortion. Attackers encrypt the firm’s files so staff cannot work, and they also threaten to release copies they claim to have taken.
What groups have claimed to take from architecture firms
Threat-intelligence sites tracked several listings of architecture firms in the first nine months of 2026. We are not naming the firms, because the claims come from criminal groups and have not been confirmed. The listings are described below by region, month and group.
- In January 2026, groups including INC Ransom, 0apt and Interlock allegedly listed several US and UK firms. They claimed CAD files and 3D renders.
- In April 2026, the Akira group allegedly listed a Canadian firm and claimed more than 180 GB, including contracts and drawings.
- In May 2026, a group called cmdorganization allegedly listed a US firm.
- In August 2026, INC Ransom allegedly listed a US firm.
- In September 2026, the Dark Project group allegedly listed a San Francisco firm and claimed about 340 GB, including drawings, HR files and Social Security numbers.
Sources for these claims include Dexpose and SOCRadar. Treat every item as alleged until a firm confirms it.
Why architecture and engineering data is valuable
A&E firms hold information that is useful to criminals and sensitive to clients. Drawings and BIM models can show the layout of secure or high-value buildings. Contracts and project files include client financial details. HR files can hold employee Social Security numbers.
Firms also work against deadlines. Losing access to files for several days can stall a bid or a submission, and that pressure can push a firm toward a hasty decision.
How attackers typically get in
Security researchers describe a few common paths:
- Stolen passwords. SOCRadar’s write-up on one group says it allegedly buys stolen login data and tests those passwords on Microsoft 365, VPN and remote access accounts.
- Accounts without MFA. A password alone may be enough when multifactor authentication is missing.
- Unpatched remote access. Outdated software on a VPN or remote tool can leave a door open.
Kaseya has reported that most ransomware attacks hit organizations with fewer than 1,000 employees. Check the original report before relying on the exact percentage. Small firms with limited IT support can be easier to reach than large ones.
What a ransomware attack costs beyond the ransom
The ransom demand is only one part of the bill. Other costs can include:
- Forensic investigation to find out what happened.
- Legal advice and notification letters to affected clients and employees.
- Downtime that delays billable work and deadlines.
- Restoring systems and data.
- Claims or complaints from clients whose information was exposed.
Which of these a policy pays for depends on the wording, limits and conditions.
Real-world example
Consider a hypothetical 15-person architecture firm that uses an outside IT provider. A staff member’s email password appears in a set of stolen logins. The same password works on the firm’s remote access tool, which has no MFA.
An attacker logs in, copies project files and HR records, and encrypts the file server. The firm cannot open drawings for a week. A few days later, it finds its name on a leak site with a deadline to pay.
The firm now faces forensic work, notification letters, delayed deliverables and questions from clients. None of that is covered simply because the firm has a cyber policy. The wording determines what responds.
Which cyber policy terms matter most
Three areas deserve a close look:
- Ransomware terms. Some policies limit or condition ransomware coverage. Whether a policy pays any ransom depends on its wording and on law, including sanctions rules, so no policy should be assumed to pay one.
- Breach response. Check whether notification, forensic and legal costs sit inside the main limit or outside it.
- Business interruption. Check the waiting period, which is the time that must pass before lost income coverage begins.
The glossary entry on pay on behalf explains how some policies handle payment of covered costs. The comparing cyber quotes page shows where to find the ransomware, breach response and business interruption lines. The cyber application also shows what carriers typically ask about MFA, backups and remote access.
What to check in your firm
Firms may want to review:
- Whether MFA is on for email, VPN and every remote access tool.
- Whether remote access software is kept up to date.
- Whether backups are stored offline or separate from the main network, and whether a restore has been tested.
- Whether the firm knows who to call first after an attack.
- Whether the cyber policy limits for breach response and business interruption fit the firm’s size.
Hardcover insight
Firms often assume ransomware happens to someone else, then learn that leak-site listings include firms of every size. The practical gap is usually simple. A reused password, a missing MFA setting or an untested backup can turn a bad day into a long one. Fixing those items also tends to make the cyber application easier to complete.
Related questions
What are ransomware leak sites?
They are websites where criminal groups list organizations they claim to have attacked. They post names, deadlines and sometimes sample files to pressure the firm into paying.
What is double extortion?
It is when attackers encrypt a firm’s files and also threaten to publish copies they claim to have stolen. The firm faces both lost access and possible exposure.
Are the firms on leak sites confirmed victims?
Not necessarily. Leak-site entries are claims made by criminal groups. Firms often have not confirmed them.
What do attackers claim to take from architecture firms?
Groups have claimed CAD files, BIM models, 3D renders, contracts, client data and employee records, including Social Security numbers. These claims remain unconfirmed.
Does cyber insurance pay a ransom?
It depends on the policy wording and applicable law. Some policies limit ransomware coverage, and legal restrictions can apply. Review the policy or ask a broker how it would handle a specific scenario.