The Rhysida ransomware group has added the City of El Cajon, a municipality in San Diego County, California, to its leak site. It claims to hold about 7.8 million files, roughly 7.8 TB, taken from the city's police department, 911 dispatch center, fire and EMS services and general administration. Threat-intelligence trackers RansomLook and ThreatMon first logged the listing on November 4, 2026. The city has not commented publicly and no regulator filing has been published, so every detail below about the scope and contents of the theft comes from the attackers' own listing as reported by monitoring services.
What Happened
RansomLook's records, summarised by mAlice.ai, show El Cajon as the newest of 15 organisations Rhysida listed between October 22 and November 4. Others in the same run include Phoenix Charter Academy, the German firm DR.SCHNELL GmbH & Co. KGaA, Sanders Law Group and the Belgian municipality of Machelen. ThreatMon reported the El Cajon listing the same day, according to Undercode News.
Reports differ on how far things have gone. QPulse describes the data as already leaked. HookPhish's copy of the listing describes it as a "lot" that is "for sale", with credentials marked as selling first. That fits Rhysida's usual approach of auctioning stolen data before publishing it. It is not yet clear whether the full dataset is public or still being offered to buyers.
According to the listing, the data is current through late September 2026 and includes SQL backups, payroll runs and 911 logs "up to the final days". The group calls it "a live dump, not an archive." The listing does not say whether systems were encrypted or whether services were disrupted, and no outage has been reported. A local news guide to city council meetings published on October 25 shows the city's public meeting portal and remote participation system working normally at that time.
RansomLook and Undercode News both stress that leak-site listings are unverified claims. The city has not confirmed an intrusion.
What Was Taken
The breakdown below comes from the listing as reproduced by HookPhish and summarised by QPulse:
- City operations: 195 employee home profiles (about 800 GB); HR, city attorney, finance and council shares (about 1.3 TB); public works and utility billing covering about 250,000 accounts (about 1.3 TB).
- Payroll: a citywide share holding W-2 tax forms. HookPhish's copy says it covers all employees of a workforce of "~1,100+". QPulse puts it at about 1,100 employees. The listing gives the share as about 2.4 TB.
- Police: a restricted police archive (about 1.7 TB). QPulse reports it includes Internal Affairs tracking files, undercover unit rosters and informant identities.
- 911 center: about 6.3 million call recordings covering roughly three years, with caller phone numbers, addresses and GPS data (about 380 GB).
- Databases: about 440 GB of SQL backups, including dispatch CAD, evidence vault, crime lab, records management, access control and the MFA server.
- Health and identity data: QPulse reports thousands of EMS patient records containing Social Security numbers, along with DMV records and credit files.
- Credentials and access: a bank ACH private key and passphrase, state treasury pool PINs, and corporate card numbers with CVV and PIN. Also listed: root access to core network equipment (the listing says this includes traffic lights), and accounts for FBI, DEA, state DOJ, CJIS and LiveScan systems. Other items include 111 officer passcodes for a narcotics system, a DMV certificate, TOTP secrets and hardware-token seeds from the MFA server, VPN data, a vendor ERP backdoor, 13 .pfx code-signing certificates, OAuth secrets, door access controls and a map of 401 cameras.
The listing's numbers do not fully add up. The categories HookPhish reproduces total about 8.3 TB, more than the 7.8 TB headline figure. That may just be rounding or overlap, but it is a reminder that these are the attackers' sales figures and nobody has independently counted them.
Why It Matters
If even part of this is accurate, the damage goes well beyond a typical municipal data leak. Three things stand out:
- Risk to people's safety. Undercover rosters, informant identities and Internal Affairs files could put people in physical danger. Three years of 911 recordings tied to callers' locations expose residents at some of the worst moments of their lives.
- Stolen credentials can be reused. QPulse warns that the exposed admin credentials and MFA server data create an immediate risk of follow-on attacks. TOTP secrets and token seeds let an attacker generate valid one-time codes, which defeats MFA until every token is reissued. Code-signing certificates can be used to sign malware. The CJIS, FBI and DEA accounts would give access to shared law-enforcement systems beyond the city's own network.
- Financial fraud. An ACH private key, treasury PINs and full card data are directly usable for payment fraud.
Government is a long-standing target for Rhysida. According to Proven Data, the group had claimed 311 victims across 42 countries as of November 2, 17 of them in the previous 30 days, with education and healthcare the most common sectors.
California's breach notification law gives organisations 30 days to notify affected residents, according to a review of state statutes by RiversideIQ, and law enforcement can pause that clock during an investigation. If the city confirms that personal data was taken, employees, EMS patients and utility customers should expect notification letters.
The Attack Technique
Nobody has said how Rhysida got into El Cajon's network. The listing does not say, and the city has not commented.
Proven Data's profile of the group describes a double-extortion operation active since May 2023 and linked to the operators previously behind Vice Society. It is tracked under names including Vanilla Tempest and GOLD VICTOR. Documented ways in include VPN accounts without MFA, fake signed software installers and "TerminalFix" lures. Once inside, Rhysida encrypts Windows, Linux and VMware ESXi systems, adds the .rhysida extension to files and leaves a ransom note named CriticalBreachDetected.pdf. A free public decryptor works on early Windows builds but not on every variant.
The listing mentions terminal-server profiles and workstation backups, and it claims the attackers dumped the MFA server. Together these suggest deep, privileged access across the domain over a long period, not a single compromised file share. That is an inference from the listing, not a confirmed finding.
What Organizations Should Do
- Reissue MFA, not just passwords. If an MFA server, its database or backups may be compromised, reset TOTP secrets and replace hardware tokens. Resetting passwords alone leaves attackers able to generate valid codes.
- Revoke certificates and payment keys. Revoke and reissue code-signing certificates, OAuth secrets and ACH or banking keys. Ask your bank and the state treasury to add extra verification on outgoing payments.
- Tell partner agencies. Agencies with CJIS, DOJ or federal system access should notify those system owners straight away so linked accounts can be disabled and checked for misuse.
- Enforce MFA on every VPN and remote access path. Accounts without MFA are a documented Rhysida entry point. Audit for leftover local accounts, default passwords and vendor support accounts, including ERP backdoors.
- Take control systems and cameras off the public internet. Traffic control, door access and camera systems should sit behind segmented networks, not on public IP addresses.
- Protect and watch backups. Keep offline or immutable backups. Alert on bulk SQL backup exports and large outbound transfers, since terabyte-scale data theft takes days or weeks.
Sources: Rhysida Ransomware Group Leaks Stolen Data from El Cajon, Californi... | El Cajon, CA Data Breach: Rhysida Ransomware Claim (Nov 2026) | Rhysida claims attacks on 13 organizations · mAlice.ai | Rhysida and SafePay Claim New Victims in the United States and Germ... | Seyfarth Shaw Data Breach Lawsuit - Class Action U | El Cajon City Council: How to Find Meeting Agendas and Register for... | State Data Breach Notification Deadlines (50 States + DC) | Rhysida Ransomware: Attack Chain, IOCs, and Recovery Options