What the construction industry’s biggest data breach means, and what builders need to do now.

Australia’s largest home builder, Metricon Homes, has confirmed it has fallen victim to a ransomware attack by international cybercriminal group Qilin — with hackers claiming to have exfiltrated 128GB of sensitive corporate data.

The breach, which came to light via Qilin’s listing on its darknet “Dedicated Leak Site,” includes claims of stolen architectural plans, internal HR files, financial documents, and staff commission and salary records.

It’s one of the most significant known cyberattacks in the Australian construction sector, and a sharp reminder that the industry is no longer off the radar when it comes to global cybercrime.

Who Are Qilin?

Qilin (also known as “Agenda”) is a Russian-speaking ransomware-as-a-service group first detected in 2022. It targets large organisations, typically through phishing emails or unprotected applications like Citrix and remote desktop tools. Once inside, the group encrypts company data and threatens to release it unless a ransom is paid.

Despite the name’s roots in Chinese mythology, a qilin is a mythical chimera that symbolises peace and wisdom — the group itself is anything but benevolent. Since emerging on the scene, Qilin has claimed over 600 victims worldwide.

Their attack on Metricon now places Australia’s construction sector firmly in their sights.

What Happened at Metricon?

Metricon first noticed disruptions to its systems in mid-July. In a public statement released this week, the company confirmed it had “become aware that a third party has named the company online alongside claims they have accessed some of our data.”

While construction work and supplier payments reportedly continued throughout the disruption, Qilin has already published partial files as proof — with threats to release the full data cache within seven days.

According to the leak, the stolen files include:

• Proprietary architectural plans
• Internal marketing strategies
• Company credit data and receipts
• HR and payroll files
• Staff names, salaries, and commission structures

Metricon says it has now restored most of its internal systems and continues to investigate the scope of the breach. A spokesperson noted that “impacted individuals will be contacted directly if data exposure is confirmed.”

The company has notified the Australian Cyber Security Centre (ACSC), the Office of the Australian Information Commissioner (OAIC), and law enforcement.

In a statement addressing stakeholders, Metricon CEO Brad Duggan said:

“We take this incident extremely seriously and are working with independent experts to understand exactly what occurred.

Our customers, team and partners expect us to protect their data, and we are committed to managing this incident with care, speed and openness.”

What Builders Should Be Doing Right Now

The Metricon breach should act as a fire alarm for the entire sector.

Here’s what every builder, supplier, and construction firm should be considering today:

1. Phishing Training Is Non-Negotiable

If your staff don’t know how to spot a fake email, they’re your weakest link. Regular training can stop most ransomware attacks before they begin.

2. Use Multi-Factor Authentication (MFA) Everywhere

It’s shocking how many businesses still rely on password-only logins. MFA (like a text code or app prompt) creates an extra layer of protection. It should be turned on for email, cloud storage, project management tools — anything sensitive.

3. Secure Your Public-Facing Systems

If your website or internal tools are accessible online, consider using a platform like Cloudflare to block malicious traffic and prevent bot-driven attacks. These tools act like a protective fence between your business and the open internet.

4. Update and Patch All Software

Old remote desktop tools and outdated applications are wide open doors. Make sure your IT team removes anything you’re not using — and keeps what you are up to date.

5. Back Up Like It Matters

Daily, offsite backups are your safety net. They need to be tested and verified regularly, not just assumed to be working. Store backups securely and separately from your live systems.

6. Build a Simple Response Plan

Know what you’d do if this happened to you. Who’s in charge? Who do you call? What will you tell clients? You don’t need a 50-page document, just a clear checklist and roles defined.

What Happens Next

This week, The Good Builder will be speaking with cybersecurity experts and construction IT professionals to help the industry better understand:

• What ransomware groups like Qilin look for
• How builders can protect their data without blowing the budget
• What to do if you’re breached
• And what cyber insurance actually covers

We’ll also be sharing practical templates, checklists, and interviews to help construction businesses build up their defences — because in 2025, cyber is just as critical as safety on site.

Final Word

If Australia’s largest builder can be breached, no one in the construction industry is off limits.

The Metricon attack is a wake-up call, and a clear sign that cybersecurity is now part of every builder’s risk profile.

It’s not about fear. It’s about being ready.

Author: The Good Builder

The Good Builder is a media platform that provides news and insights for Australia’s home building industry. From exclusive stories and curated insights to bold industry perspectives, we deliver the news and updates that keep builders, suppliers, and the entire home building industry inspired and ahead of the curve.