Syracuse Police Department

Summary

The Syracuse Police Department discovered unauthorized access to its digital files, prompting an investigation that cost the city $250,000. Notification letters were sent to potentially affected individuals, indicating that Social Security numbers and other personal data might have been compromised, and the city provided free credit monitoring and identity protection services.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In early January 2025, the Syracuse Police Department detected a security incident involving its information technology system on January 11. Upon detection, the department shut down its computer system to prevent the issue from spreading, and it took several weeks for the system to be fully restored. The city characterized the event as a security incident and subsequently engaged cybersecurity and forensic specialists to investigate suspicious activity on the network. According to a letter sent to potential victims, the investigation determined that certain digital files were accessed or acquired without authorization between January 10 and January 12, 2025.

The forensic review examined the content of the accessed files to identify all individuals named within them and the specific information contained about each person. Sources familiar with a briefing to the Syracuse Common Council indicated that as many as 15,000 individuals were named in the compromised files, which span records dating back to the 1980s. Although the exact nature of the data compromised was not disclosed, a March 27 letter to one potential victim noted that the individual's Social Security number could have been involved. Following the conclusion of the investigation, the city began issuing breach notification letters in late March 2026 through the cybersecurity firm IDX.

Recipients of the letters were offered 12 months of free IDX credit monitoring and identity protection services, and the letters included a QR code and an online link for enrollment, as well as a return address to a post office box in California maintained by IDX. The city stated that the notifications and services were provided out of an abundance of caution and in compliance with state and federal breach disclosure laws, and that at the time of the notice it was not aware of any confirmed exposure of personal information. The total cost to taxpayers for the response was reported as $250,000, representing the deductible under the city’s cybersecurity insurance policy, with the insurer covering additional expenses such as mailing and credit monitoring. City spokesperson Sol Muñoz emphasized that the incident was taken seriously and that the city remains committed to protecting entrusted information. In a broader context, the article notes that in 2025 approximately 278.9 million breach victim notices were issued in the United States, a figure 79% lower than in 2024, reflecting a shift by attackers toward more frequent, targeted attacks on high‑value data sources.

Sources

Sources available to members: 1 source.