Andersen Construction: vortex ransomware group claims attack
RansomLook reports vortex ransomware group claims Andersen Construction on its leak site; victim has not confirmed, so monitor official statements.
- Published
- Updated
- Ecosystem
- Enterprise software
- Exploitation
- No confirmation. The only evidence is a leak-site listing reported by RansomLook, which is a claim and not proof.
What happened
According to RansomLook, a ransomware leak-site tracker, the vortex ransomware group claims Andersen Construction on its leak site. One RansomLook entry dated 2026-11-09 describes the claim as “200+ GB” RansomLook. A second entry dated 2026-11-10 repeats that the group claimed Andersen Construction on its leak site RansomLook.
Only the headlines could be retrieved, so the full articles could not be reviewed. A leak-site listing is the group’s claim, not proof of an intrusion. Andersen Construction has not confirmed the claim in the material available. Not confirmed: whether any attack occurred, what data was taken, the size of any data set beyond the group’s own “200+ GB” figure, how access was gained, and whether any data has been published.
Am I affected?
Not confirmed. The sources do not describe which people, customers or systems might be involved, and they do not say that Andersen Construction has verified any incident. If you deal with the company, there is no sourced basis here to say your data is involved.
What to do now
- Check Andersen Construction’s official channels for a statement. None is cited in the sources.
- If you work with the company, treat unexpected emails or calls about this claim with normal caution and confirm requests through contacts you already know.
- Revisit this advisory if the company or an independent outlet confirms or denies the claim.