Foster City

Summary

Foster City suffered a ransomware attack that forced the pause of all non-emergency public services and prompted officials to warn that personal information may have been compromised. The city remained in recovery for weeks afterward, and no group has publicly claimed responsibility for the incident.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On March 19, 2026, Foster City, California experienced a ransomware attack that compromised its information technology systems. The malicious software encrypted critical files and disrupted normal city operations. In response, the city was forced to pause all public services except those essential for emergency responses. This interruption affected routine administrative functions, public facilities, and non‑essential municipal programs.

City officials promptly declared a state of emergency to mobilize resources and coordinate the response effort. They issued a warning that the attackers may have obtained personal information belonging to residents, employees, or other individuals whose data was stored on the city’s networks. Despite the disruption, emergency services such as police, fire, and medical response continued to operate without interruption. The city reported that recovery efforts were ongoing and that normal services remained suspended for several weeks following the incident.

In the month after the attack, no ransomware group or threat actor publicly claimed responsibility for the intrusion. Investigators worked to determine the origin and scope of the breach while the city focused on restoring systems and assessing potential data exposure. The lack of a public claim left officials without a clear attribution point, and the city continued to monitor for any signs of further compromise or misuse of the potentially accessed information. The incident underscored the vulnerability of municipal networks to ransomware and prompted ongoing internal reviews of cybersecurity posture.

Sources

Sources available to members: 2 sources.