Foster City ransomware halts municipal services; personal-data notices follow restoration
Ransomware disrupted Foster City’s municipal services in March. Services returned on 16 April, but personal records may have been taken. Affected people should check their notification letters, use offered identity protection and monitor accounts.
If you receive a Foster City notification, check which information it identifies and enrol in the offered identity protection before your letter’s deadline. Monitor bank, card and health insurance statements, and consider freezing your credit with Equifax, Experian and TransUnion if identity details were involved. For questions about whether you were affected, call the city’s published incident line on (844) 959-7167.
What’s happening
Foster City, California, discovered ransomware on 19 March 2026, paused non-emergency public services and subsequently declared an emergency. The city announced full service restoration on 16 April. Investigators later established that an unauthorised party accessed city systems between 28 February and 25 March and may have taken files. The city says potentially exposed information included names, birth dates and health insurance numbers; some people’s records also included driving-licence, passport, bank account, payment card, medical or Social Security details. It mailed notifications where it had valid contact information and arranged identity protection for people whose driving-licence or Social Security numbers were involved. California recorded notification filings in July and October. The public notice gives 10 June as the personal-information review date, while the October-filed letter gives 6 August without explaining the difference. As of 3 November, the latest reviewed letter reports no known misuse; the reviewed sources do not establish an affected-person total, ransom payment or criminal charges.
- What
- Breach
- Affects
- Foster City municipal services and personal records
- Fixed in
- Nothing to patch
- Since
- 19 Mar 2026
- Closed
- 15 Oct 2026
Timeline
- Update
California recorded another notification filing for the same incident. The accompanying city letter offers one year of Experian credit monitoring and says the city knows of no resulting misuse of personal information.
- Update
The city’s October-filed notification letter identifies this as its personal-information review completion date. Its earlier letter and public notice instead give 10 June; the reviewed notices do not explain the different dates.
- Update
California’s Attorney General recorded a breach-notification filing from the city covering the 28 February–25 March incident.
- Update
The city’s public notice says it determined that affected files contained personal information. Potentially involved details included identity, health, insurance and financial information, varying by person.
- Update
The city announced full restoration of public services, including building permits, recreation registration and online utility payments.
- Update
The City Council approved an emergency declaration. ABC7 reported that most computer systems had been taken offline as a precaution and public services remained limited.
- Made public
City IT staff discovered ransomware early that morning, and non-emergency public services were paused. The city said 911 and police dispatch were operational; whether information had been accessed was still uncertain.
- UpdateNothing to patch
Unauthorised access to Foster City’s computer systems began, according to its later investigation. The access continued through 25 March, and files may have been viewed or taken.
Sources
- Foster City Services Impacted by Cyber Security BreachCity of Foster City · 19 Mar 2026
- Foster City Restores Full Functionality of Public ServicesCity of Foster City · 16 Apr 2026
- Cyber Event NoticeCity of Foster City
- Notice of Data Breach — initial sample notificationCity of Foster City
- Notice of Data Breach — sample notification filed in OctoberCity of Foster City
- Search Data Security Breaches — City of Foster City filingsCalifornia Department of Justice
- California city reports ransomware attack as LA transit agency finds ‘unauthorized activity’The Record · 20 Mar 2026
- Foster City declares emergency after cyberattack forces city computer system offline for daysABC7 San Francisco · 24 Mar 2026