{"id":"foster-city-ransomware-data-breach-mar-2026","category":"breach","status":"closed","title":"Foster City ransomware halts municipal services; personal-data notices follow restoration","tldr":"Ransomware disrupted Foster City’s municipal services in March. Services returned on 16 April, but personal records may have been taken. Affected people should check their notification letters, use offered identity protection and monitor accounts.","summary":"Foster City, California, discovered ransomware on 19 March 2026, paused non-emergency public services and subsequently declared an emergency. The city announced full service restoration on 16 April. Investigators later established that an unauthorised party accessed city systems between 28 February and 25 March and may have taken files. The city says potentially exposed information included names, birth dates and health insurance numbers; some people’s records also included driving-licence, passport, bank account, payment card, medical or Social Security details. It mailed notifications where it had valid contact information and arranged identity protection for people whose driving-licence or Social Security numbers were involved. California recorded notification filings in July and October. The public notice gives 10 June as the personal-information review date, while the October-filed letter gives 6 August without explaining the difference. As of 3 November, the latest reviewed letter reports no known misuse; the reviewed sources do not establish an affected-person total, ransom payment or criminal charges.","action":"If you receive a Foster City notification, check which information it identifies and enrol in the offered identity protection before your letter’s deadline. Monitor bank, card and health insurance statements, and consider freezing your credit with Equifax, Experian and TransUnion if identity details were involved. For questions about whether you were affected, call the city’s published incident line on (844) 959-7167.","product":"Foster City municipal services and personal records","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["foster-city","ransomware","data-breach","local-government","identity-theft"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Foster City Services Impacted by Cyber Security Breach","url":"https://www.fostercity.org/m/newsflash/home/detail/245","by":"City of Foster City","date":"2026-03-19"},{"kind":"advisory","title":"Foster City Restores Full Functionality of Public Services","url":"https://www.fostercity.org/m/newsflash/home/detail/247","by":"City of Foster City","date":"2026-04-16"},{"kind":"advisory","title":"Cyber Event Notice","url":"https://www.fostercity.org/1326/5895/Cyber-Event-Notice","by":"City of Foster City","date":""},{"kind":"advisory","title":"Notice of Data Breach — initial sample notification","url":"https://oag.ca.gov/system/files/ELN-27469%20Foster%20City%20Adult%20CM%2012%20months%20r4prf_Redacted.pdf","by":"City of Foster City","date":""},{"kind":"advisory","title":"Notice of Data Breach — sample notification filed in October","url":"https://oag.ca.gov/system/files/ELN-28528%20Foster%20City%20-%20Adult%2012%20months%20CM.pdf","by":"City of Foster City","date":""},{"kind":"advisory","title":"Search Data Security Breaches — City of Foster City filings","url":"https://oag.ca.gov/privacy/databreach/list?field_sb24_org_name_value=City+of+Foster+City","by":"California Department of Justice","date":""},{"kind":"news","title":"California city reports ransomware attack as LA transit agency finds ‘unauthorized activity’","url":"https://therecord.media/california-city-reports-ransomware-attack-la-metro","by":"The Record","date":"2026-03-20"},{"kind":"news","title":"Foster City declares emergency after cyberattack forces city computer system offline for days","url":"https://abc7news.com/post/foster-city-declares-emergency-cyberattack-forces-computer-system-offline-days/18759516/","by":"ABC7 San Francisco","date":"2026-03-24"}],"started":"2026-03-19","closed":"2026-10-15","created":"2026-11-03T21:50:00.434Z","updated":"2026-11-03T21:50:00.434Z","cve_notes":[],"timeline":[{"at":"2026-10-15","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"California recorded another notification filing for the same incident. The accompanying city letter offers one year of Experian credit monitoring and says the city knows of no resulting misuse of personal information.","url":"https://oag.ca.gov/system/files/ELN-28528%20Foster%20City%20-%20Adult%2012%20months%20CM.pdf","by":"City of Foster City","patch":null},{"at":"2026-08-06","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"The city’s October-filed notification letter identifies this as its personal-information review completion date. Its earlier letter and public notice instead give 10 June; the reviewed notices do not explain the different dates.","url":"https://oag.ca.gov/system/files/ELN-28528%20Foster%20City%20-%20Adult%2012%20months%20CM.pdf","by":"City of Foster City","patch":null},{"at":"2026-07-13","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"California’s Attorney General recorded a breach-notification filing from the city covering the 28 February–25 March incident.","url":"https://oag.ca.gov/privacy/databreach/list?field_sb24_org_name_value=City+of+Foster+City","by":"California Department of Justice","patch":null},{"at":"2026-06-10","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"The city’s public notice says it determined that affected files contained personal information. Potentially involved details included identity, health, insurance and financial information, varying by person.","url":"https://www.fostercity.org/1326/5895/Cyber-Event-Notice","by":"City of Foster City","patch":null},{"at":"2026-04-16","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"The city announced full restoration of public services, including building permits, recreation registration and online utility payments.","url":"https://www.fostercity.org/m/newsflash/home/detail/247","by":"City of Foster City","patch":null},{"at":"2026-03-23","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"The City Council approved an emergency declaration. ABC7 reported that most computer systems had been taken offline as a precaution and public services remained limited.","url":"https://abc7news.com/post/foster-city-declares-emergency-cyberattack-forces-computer-system-offline-days/18759516/","by":"ABC7 San Francisco","patch":null},{"at":"2026-03-19","added":"2026-11-03T21:45:10.669Z","kind":"disclosed","text":"City IT staff discovered ransomware early that morning, and non-emergency public services were paused. The city said 911 and police dispatch were operational; whether information had been accessed was still uncertain.","url":"https://www.fostercity.org/m/newsflash/home/detail/245","by":"City of Foster City","patch":null},{"at":"2026-02-28","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"Unauthorised access to Foster City’s computer systems began, according to its later investigation. The access continued through 25 March, and files may have been viewed or taken.","url":"https://www.fostercity.org/1326/5895/Cyber-Event-Notice","by":"City of Foster City","patch":"na"}],"url":"https://hard.fyi/live/foster-city-ransomware-data-breach-mar-2026/","json":"https://hard.fyi/api/live?id=foster-city-ransomware-data-breach-mar-2026"}