Skip to content
Leak-site post naming EllisDon Corporation, captured by ThreatCluster

EllisDon Corporation

metaencryptor

Ransomware leak-site victim intelligence

Data size
1.4 TB
Files
3
Posted
Sep 7, 2026
Country
Canada
Industry
construction services and technology

Summary

Written by ThreatClusterfrom victim profile, leak post, screenshot, our reporting

Metaencryptor claims 409 GB of EllisDon Corporation data has been exfiltrated and published on the group's leak site. The leak page shows a 17-day countdown deadline and the publication status is listed. EllisDon Corporation is described in the post as a Canadian construction and infrastructure services company. The group states the data includes internal documents and source code, among other items.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Employees
0

What was taken

EllisDon Corporation is a leading Canadian construction and infrastructure services company. Founded in 1951, the company provides construction management, engineering, project development, and facilities management services across a wide range of sectors, including healthcare, transportation, commercial, industrial, government, and defense infrastructure. EllisDon operates across Canada and internationally.

File types seen
dwg × 1pdf × 2
Sample files (3)
Ai3-235.dwg
Business Insurance Policy.pdf
Ellisdon.pdf

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Update
Files added; Over the past 24 hours, we have succeeded in exfiltrating an additional 1 TB of internal data. The company remains vulnerable.
75 years
75 years
100% Employee Owned
100% Employee Owned
Update: Files added
Update: Over the past 24 hours, we have succeeded in exfiltrating an additional 1 TB of internal data. The company remains vulnerable.

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture