On September 18, 2026, the ransomware crew EndZone listed Accela, Inc. on its leak site, claiming it had exfiltrated more than 50 GB of data from the San Ramon, California govtech vendor whose permitting, licensing, and code enforcement platform sits behind hundreds of state and local government agencies. The claim, reproduced identically by DeXpose and HackerFeeds and flagged the same day by the ThreatMon Threat Intelligence Team, alleges over 2 million lines of user PII and 6 million citizen-service requests, including records the group says belong to FBI agents, police officers, and other government workers. Accela has not publicly responded to the EndZone listing, and no source reviewed here contains independent verification of it. Complicating the picture considerably: Accela separately notified the California Attorney General on September 14, 2026, four days before the EndZone post, of a different intrusion dating to December 2025 that a different group, Everest, claimed. Accounts of what happened to Accela this year do not cleanly resolve into one incident.
What Happened
There are two distinct events in the source material, and conflating them would be a mistake.
The September 2026 EndZone claim. EndZone added Accela to its victim list on September 18, 2026, alongside a simultaneous claim against AT&T. UndercodeNews, relaying ThreatMon, timestamps the AT&T alert at roughly 10:06 UTC+3 that day. HackerFeeds classifies the Accela listing under Government & Defense, US, and rates it MEDIUM severity, while explicitly noting the details "have not been independently verified." DeXpose and HackerFeeds publish the same verbatim actor statement, which reads as a pre-negotiation pressure post rather than evidence of encryption: "Speak soon or Leak soon!" No source establishes an intrusion vector, a dwell time, whether systems were encrypted, or whether Accela is negotiating. UndercodeNews is unusually direct about this, cautioning that a leak-site listing "can indicate an alleged compromise, but confirmation generally requires additional evidence."
The December 2025 Everest incident. Per the California Attorney General filing reported by GalaxyWarden and ClaimDepot, an unauthorized actor accessed one of Accela's secure file transfer portals and acquired copies of files between December 11 and December 12, 2025. On December 23, 2025, Everest claimed the intrusion on the dark web, asserting it held 1 terabyte of Accela internal data and would publish within seven to eight days. Accela filed with the California AG on September 14, 2026, which GalaxyWarden calculates as 277 days after the incident date. ClaimDepot reports Accela's position that only Accela's own systems were involved and that government agency clients' systems were not affected.
Whether EndZone's September claim represents a fresh intrusion, a rebrand or affiliate repackaging of the Everest data, or an opportunistic listing riding a publicised breach, the sources do not say. The volume figures point away from a simple repackaging: Everest claimed 1 TB, EndZone claims 50 GB.
One note on sourcing hygiene. A DeXpose post dated September 19, 2026 covering an Emperador ransomware claim against Cassia, MG in Brazil circulates in the same feed cluster as the Accela item. It is an unrelated incident against a Brazilian municipal government and has no bearing on Accela.
What Was Taken
The two events produce two very different inventories, and the reported figures do not reconcile.
From the EndZone leak-site post, as published by DeXpose and HackerFeeds:
- Over 50 GB of data total
- Over 2 million lines of user data containing PII
- 6 million user requests from Accela's citizen engagement portal, the channel through which residents report non-emergency neighborhood issues, also described as containing PII
- Government personnel data the group characterises as spanning "FBI agents to cops to regular government workers"
- The post also cites Accela revenue of $144.4 million, standard leak-site framing intended to signal ability to pay
From the Everest claim and the California AG filing:
- Everest claimed approximately 1 terabyte of internal data (per ClaimDepot and Emery Reddy)
- The AG filing itself does not state how many people were affected, does not disclose root cause, and does not confirm whether data was copied, according to GalaxyWarden
On the categories of personal information, the sources directly contradict each other. ClaimDepot tabulates names, Social Security numbers, dates of birth, addresses, government IDs, medical information, and financial information, while in the same breath stating that affected information types are "not yet disclosed" and that exposed data types "vary by individual." GalaxyWarden reads the same filing as establishing only that personal information was involved, and states affirmatively that no passwords or credentials were exposed, meaning existing Accela accounts are not at direct takeover risk. Treat ClaimDepot's category list as a claim-site checklist rather than a confirmed disclosure until Accela or a regulator publishes specifics.
Data volume claims here therefore range from 50 GB (EndZone, September 2026) to 1 TB (Everest, December 2025), and record counts range from "over 2 million lines" plus 6 million portal requests (EndZone) to entirely unstated (the California AG filing).
Why It Matters
Accela is a single point of aggregation for an enormous amount of routine civic data. Permitting, licensing, and code enforcement workflows collect contractor licence numbers, property addresses, business filings, applicant identity documents, and inspection histories across hundreds of jurisdictions. The citizen engagement portal that EndZone specifically names is worse from a privacy standpoint than it sounds: non-emergency reports tie a named resident to a home address and to a grievance about a neighbour, a landlord, or a local condition. Six million such records, if the claim holds, is a mass geolocated complaint database.
The claimed presence of federal and local law enforcement personnel records raises the stakes past ordinary identity theft into targeting risk. Names and home addresses of FBI agents and police officers have a resale value and an operational use that a generic consumer PII dump does not.
The vendor-shaped notification problem is the second-order lesson, and Emery Reddy captures it well: because Accela is a B2G vendor rather than a consumer brand, notification letters go out on behalf of the specific government client whose data was involved, not under the Accela name. Recipients may never see the word "Accela" in their letter. That structure quietly suppresses the perceived scale of a vendor breach, because no single agency's notification reveals the aggregate footprint.
Finally, the 277-day gap between the December 2025 incident and the September 2026 California filing is itself the finding. Nine months of silence means affected individuals spent three quarters of a year unable to act while their data was, by Everest's account, already staged for publication.
The Attack Technique
For the December 2025 event, the sources agree on a specific and increasingly familiar vector: an unauthorized actor accessed one of Accela's secure file transfer portals and copied files over a roughly 24-hour window, December 11 to 12, 2025. Both ClaimDepot and Emery Reddy describe it this way, citing the California AG notice. Managed file transfer and secure file exchange systems have been the highest-yield target class in data extortion for several years running, because they are internet-facing by design, hold bulk data staged for exchange between organisations, and frequently sit outside the EDR and logging coverage applied to core enterprise systems. The exfiltration-only pattern, copy files, skip encryption, extort on publication, matches that target class precisely.
For the September 2026 EndZone claim, no vector is known. The leak-site text describes outcomes, not method, and no source reports initial access, persistence, lateral movement, or encryption. Anyone presenting a technique for the EndZone event is inventing it.
What Organizations Should Do
If your agency uses Accela or any comparable civic SaaS platform:
- Inventory what you have actually sent the vendor. Pull your file transfer and API integration history with Accela, especially anything staged around December 11 to 12, 2025. You cannot assess resident exposure without knowing which of your datasets left your perimeter.
- Audit every managed file transfer surface you own or consume. Enumerate internet-facing MFT and secure portal instances, confirm patch level, enforce MFA on all accounts including service accounts, restrict access by IP or Zero Trust policy, and alert on bulk download volume rather than only on login anomalies.
- Assume notification will not reach you through the vendor. Coordinate now with your legal and privacy teams on who drafts resident notices when a vendor breach touches your data, because under the pattern Emery Reddy describes, the letter carries your agency's name, not the vendor's.
- Treat law enforcement and public-safety personnel records as a distinct risk tier. If your jurisdiction's data in Accela includes officer or agent identifiers, escalate to your security or threat management function rather than handling it purely as a consumer privacy matter.
- Push the vendor for specifics in writing. Ask directly whether the September 2026 EndZone listing is a new intrusion or a repackaging of the December 2025 data, what the confirmed data categories are, and what the per-jurisdiction record counts are. The public filing answers none of these.
- Route affected individuals to the official remedy. Per ClaimDepot, Accela is offering one year of complimentary identity monitoring through Kroll, activated with the membership number in the personal notification letter, with a dedicated line at 844-301-0074, Monday to Friday, 9:00 a.m. to 6:30 p.m. Eastern. Note that this remedy attaches to the December 2025 incident; no comparable programme has been announced for the EndZone claim.
- Tighten monitoring for downstream fraud with a long tail. Names, SSNs, and dates of birth, if confirmed exposed, support synthetic identity fraud and benefits fraud that surfaces years later. Monitoring for twelve months is a floor, not a resolution.
Sources: EndZone Ransomware Targets Accela Inc. - DeXpose | EndZone Ransomware Claims AT&T and Accela as New Victims in a Fresh... | Accela, Inc. Data Breach Notice (California Attorney General) Gala... | Accela Data Breach Exposes 1TB of Data | Accela Data Breach Lawyer Emery Reddy | Emperador Ransomware Hits Cassias MG Government - DeXpose | Ransomware group EndZone hits Accela.com HackerFeeds