Procore Technologies

Procore Technologies was listed by an actor operating as OROVA on August 26, 2026. The listing has not been independently verified, the company has not publicly confirmed an incident, and no data types have been disclosed as of this writing.

Procore builds construction management software used across commercial, industrial, institutional, and public sector projects.

Not disclosed. What a construction management platform holds, labeled as inference from the product's function: architectural drawings and structural plans, mechanical and electrical layouts, site access procedures, security system installation details, inspection and compliance records, contracts, and daily site logs.

There is also a workforce layer. Construction platforms carry subcontractor records, worker certifications, and safety incident reports for the many small trade businesses working on each project.

For an ordinary office development, exposed plans are commercially sensitive and little more. The harm profile changes entirely with the building type.

Plans for a data centre, a hospital, a courthouse, a utility substation, or a school describe the location of the electrical room, the routing of network infrastructure, the placement of access control readers and cameras, and the points at which the building can be entered. Those buildings exist now and people are inside them. Documentation of that kind is operational security information about a physical target, and unlike a password it cannot be changed after disclosure.

The workforce layer carries a more ordinary harm to people who have the least protection: subcontractor employees whose certifications, injuries, and personal details sit in a platform their employer never assessed and they never heard of.

While not publicly confirmed for Procore, enterprise construction platforms serving public sector and institutional clients typically hold recognised security certifications, because government and institutional procurement requires them.

Certification frameworks assess controls against a defined scope, and the scope is almost always framed around personal data and service availability. A building's electrical layout is neither. It passes through the assessment as project content — the customer's material, held on the customer's behalf — without ever being classified by what disclosure of it would enable.

Data classification asks a consistent question: does this record identify a person, and does it contain a regulated element. That question is well designed for privacy risk and blind to physical risk.

A floor plan identifies nobody. It contains no regulated element. It would be rated low sensitivity by every classification tool in common use, while describing exactly how to enter a building unobserved. The same blind spot covers facility diagrams, network topology documents, guard rotation schedules, and the site plans held by architecture and engineering firms.

For a platform holding project data across thousands of buildings, the question of which of those buildings are sensitive is not answerable from the schema. It requires knowing what the projects are.

Personal data notification obligations would attach to the workforce records — names, certifications, and safety incident details for subcontractor employees engage state statutes and, for international projects, GDPR.

The plans themselves generate almost no statutory obligation and a great deal of contractual and practical work. Every affected project owner needs to know whether their building's documentation was included, and for government, healthcare, and critical infrastructure clients that conversation may trigger physical security reviews and, in some cases, changes to the buildings themselves. There is no regulator to file with and no template for the notification.