Incident Overview

The threat actor "zestix" claims to be selling data allegedly stolen from Elford, Inc., a U.S.-based construction and general contracting company. The compromised data reportedly consists of 475 internal project files totaling approximately 1.55 GB, related to the Boys & Girls Club Milo-Grogan construction project.

Elford, Inc. is an established construction company operating in the United States, providing general contracting and construction management services for commercial, institutional, and industrial projects. The company handles complex building projects requiring detailed technical documentation, subcontractor coordination, and strict adherence to architectural and engineering specifications.

According to the threat actor's post dated December 28, 2025, the leaked dataset contains sensitive technical and project management documents from an active construction project. The compromised files allegedly include: