Ransomware News
El Cajon, CA Data Breach: Rhysida Ransomware Claim (Nov 2026)
Admin
HookPhish team
Summary
In the latest cybersecurity news, El Cajon, CA — an organization based in US — has fallen victim to a ransomware attack conducted by the group rhysida. This data breach, discovered on 2026-11-04T16:55:52.365993+00:00, underscores the increasing need for proactive cybersecurity defenses as we continue through 2026.
Incident Report
| Attribute | Information |
|---|---|
| Target Organization | El Cajon, CA |
| Threat Group | rhysida |
| Summary | El Cajon, CA LOT DESCRIPTION (brief) – U.S. municipal dump: police + 911 + production SQLWhat is for sale. Municipal government of a U.S. city (California): police department, 911 dispatch center (joint authority), fire/EMS, all city services, ~1,100+ employees. ~7.8M files / ~7.8 TB. Content current through late September 2026 – SQL backups, payroll runs and 911 logs up to the final days. Live dump, not an archive. Full snapshot: entire file server, restricted police shares, the 911 center, production databases, workstation backups and terminal-server profiles.Contents. Employee home profiles �195 (~800 GB) � department shares – HR/city attorney/finance/council (~1.3 TB) � public works + utility billing for ~250K accounts (~1.3 TB) � citywide share with W-2s for all employees (~2.4 TB) � restricted police archive (~1.7 TB) � 911 center: ~6.3M call recordings over ~3 years + caller phone/address/GPS metadata (~380 GB) � SQL backups (~440 GB: dispatch CAD 17+ GB, evidence vault, crime lab, RMS, access control, MFA server).Credentials and access (sells first). Bank ACH private key + passphrase, state treasury pool PINs, corporate cards with PAN+CVV+PIN � root/enable on the network core (incl. traffic lights) � government accounts (FBI, DEA, state DOJ, CJIS, LiveScan) + 111 officer passcodes to the narcotics system � DMV certificate + password � MFA server dump (TOTP secrets, hardware-token seeds, VPN) � password templates/defaults, vendor ERP backdoor � cameras on public IPs � 13� .pfx signing certs, OAuth secrets, door/access control, map of 401 cameras, gate codes.Personal data. W-2s for all ~1,100 employees (SSN+salary+address) � applicant SSN sets � thousands of EMS patient records with SSN � 337 DMV records � credit dossiers with IRS transcripts � home addresses of the mayor and council � 911 caller GPS metadata (above) � production CAD: ~89K incidents, ~3.9K arrests, 941 warrants, 8.3K SSNs.Police kompromat. Internal Affairs master tracker (1,016 rows / ~10 years, named: use of force �239, pursuits �172, claims �223) + 25-year legacy archive (force �998, complaints �2,612) � DA ‘untruthful officers’ list � registry of 691 destroyed discipline files + litigation hold list � officer DUI/DV (arrests; victim of an untaken DV call later killed) � fresh 2025�26 cases (negligent discharge + lies � 58-min discipline audio included; fabricated pursuit; theft during arrest) � undercover unit rosters, named + informants (names/DLs/phones) � cold cases (suspects/witnesses) � SWAT callout sheets with personal cell phones � 81 real warrant templates with witnesses � CI/surveillance playbooks � 911 data fed to federal immigration agencies + active court fight with the state AG over surveillance data sharing � county election-office correspondence, PRA packages, protest recordings with caller numbers.Finance/mail. ~77 GB of email archives (HR investigations ~37 GB) � 13 years of payroll � grants � 4 layoff waves � asset forfeiture case files � GIS/document-system credentials.Buyers. Extortion crews (headline-ready topics already in the news cycle) � fraud (W-2/SSN/medical) � IABs (live access to a city 911/CAD is a rare lot) � plaintiffs’ attorneys (new suits, case reviews) � media (ready stories) � intelligence services (undercover rosters, informants, LE-systems access) � criminals (sources and witnesses).Deal formats. Full lot exclusive � credentials package (<1 GB, samples before deal) � PII packs by class � police package for media/negotiation � first-publication rights. Freshness: A=2026 (live data), B=2024�25 (active cases), C=25+ year legacy (pattern proof).Limitations. Some containers are encrypted (passwords not recovered), video archives unreviewed; the data contains live police sources – handle with care. More |
| Date of Breach | 2026-11-04T16:55:32.680456+00:00 |
| Discovery Date | 2026-11-04T16:55:52.365993+00:00 |
| Region | US |
| Business Sector | Not Found |
How to reduce your ransomware risk
Most ransomware intrusions start with a stolen password or a phishing email. A few proactive steps sharply cut your exposure:
- phishing simulation — close the gap attackers exploit.
- security awareness training — close the gap attackers exploit.
Want to know if you’re already exposed? Run a free scan with the HookPhish data breach checker.
Disclaimer
HookPhish does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.
