The Devman ransomware group has listed the City of Seal Beach, California (sealbeachca.gov) on its leak site. It claims to have stolen and published 300 GB of city government data, which it says includes government documents and property deeds. Threat intelligence firm Siberpol tracks leak sites and recorded the posting. It says the listing went up on January 12, 2026, one day after an alleged intrusion on January 11. A second group is also involved. Siberpol separately reports that the Qilin ransomware group listed both the City of Seal Beach and the Seal Beach Police Department on its own leak site on March 1, 2026, and Qilin's claim points to the same January 11 start date. The city has not made a public statement, no breach notice has been filed with the California Attorney General, and no established security outlet has independently confirmed either claim. Both claims should be treated as unverified attacker statements.
What Happened
According to Siberpol's write-up of the Devman listing, the group named sealbeachca.gov on January 12, 2026. It claimed to have exfiltrated 300 GB of data and said that data has now been leaked. Devman did not publish a file count or a ransom demand, according to Siberpol.
Seven weeks later, Siberpol reports, Qilin posted the City of Seal Beach and the Seal Beach Police Department to its leak site. Qilin also gave no data volume or ransom figure. It did publish screenshots of documents it says came from the city's and the police department's systems.
Two groups claiming the same small city is unusual, and the shared January 11 date makes it more notable. Accounts don't settle what it means. One possibility is that one intrusion led to two extortion attempts, through affiliates moving between programs or stolen data being passed on or resold. Another is that the city was hit twice. A third is that one or both claims are inflated. Because the only reports come from leak-site monitoring, none of these explanations can be confirmed. Siberpol notes that little public information exists about Devman, which makes its claim harder to judge than Qilin's. Qilin is a well-established operation.
Siberpol published both write-ups on November 10, 2026, months after the original postings. As a result, the claims are only now getting wider attention, even though any leaked data may have been circulating since January or March.
What Was Taken
The two groups describe different data:
- Devman (claimed volume: 300 GB): government documents and property deeds, according to Siberpol's summary of the listing.
- Qilin (no volume stated): screenshots that Siberpol says show identity information, official correspondence and administrative documents tied to the city and its police department.
No figure is available for how many residents, employees or officers might be affected. The 300 GB figure comes only from Devman and has not been checked by anyone else.
The data types still matter. Property deeds and identity documents support property fraud and identity theft. Any police department material, if real, could expose information about officers, witnesses, victims or ongoing cases, which would be far more serious than ordinary municipal paperwork. For now that risk is based only on Qilin's screenshots and has not been confirmed.
Why It Matters
Seal Beach is one more case in a heavy run of data exposures affecting Californians this year.
- Schools: The Record and Malwarebytes report that assessment contractor Educational Testing Service lost data on California public school students. Attackers used compromised credentials on an SFTP site between May 22 and September 18. The data covers all students enrolled over the past three school years, and more than 5.7 million students were enrolled in 2025.
- Payment vendors: Open Class Actions reports that Turbo Data Systems, which processes citation payments for California agencies including Caltrain, is only now notifying people that names and Social Security numbers may have been accessed in November 2024. The notices are arriving almost two years after the incident.
- Hospitals: Medical Daily reports that Hoag Hospital in nearby Newport Beach detected suspicious activity on October 8. It has not said how many people were affected or what caused the incident.
These cases share two traits. Disclosure is slow, and the data often sits with contractors or in file-transfer systems nobody watches closely. Ostorlab's research newsletter makes the same point: internet-facing file-sharing servers "look like plumbing" but sit right next to sensitive data.
Small cities like Seal Beach usually have thin security staffing, shared networks between city hall and the police, and large archives of records about residents. They are an ideal target for double extortion, where attackers both encrypt systems and threaten to publish stolen data. When two groups name the same victim, it suggests the city's data, or access to its network, may have changed hands more than once.
The Attack Technique
Neither group has said how it got in, and the city has not commented. Nothing published so far links this incident to a specific vulnerability.
Recent research shows what defenders of municipal networks are facing. In a November analysis, Kaspersky's Securelist team describes a Storm-2603 intrusion that exploited the ToolShell flaws in on-premises Microsoft SharePoint (CVE-2025-53770 and CVE-2025-53771). The attackers ran an implant entirely inside the IIS worker process (w3wp.exe) without writing anything to disk. They then enumerated accounts over SAM RPC, tried to kill endpoint detection tools and attempted to deploy ransomware. Local governments widely run on-premises SharePoint for document management, and this kind of fileless access gets past file-based detection.
The ETS breach shows another common route: compromised credentials on an exposed SFTP site. Ostorlab's analysis of a ShareFile Storage Zone Controller pre-authentication remote code execution chain shows that internet-facing file-sharing servers are being targeted directly.
None of these examples is tied to Seal Beach. They show the entry points ransomware operators are currently exploiting against organizations like it.
What Organizations Should Do
- Patch and hunt on SharePoint and file-transfer servers. Confirm on-premises SharePoint is patched for CVE-2025-53770 and CVE-2025-53771, and rotate ASP.NET machine keys if you were exposed before patching. Look for suspicious ToolPane requests and unexpected .NET assemblies loaded into w3wp.exe, as Securelist's detection guidance describes. Apply the same scrutiny to SFTP, ShareFile and similar systems.
- Enforce MFA on every remote and file-transfer login. The ETS breach came down to one compromised account on an SFTP site. Remove single-factor access to any system holding records about residents.
- Separate police networks from general city IT. Keep police systems and records on separate network segments with separate admin credentials, so a compromise of city hall does not reach police data.
- Monitor leak sites for your own name. Seal Beach's listings were only reported widely months after they were posted. Subscribe to leak-site monitoring so you know about a claim before the data spreads, and check whether more than one group is claiming you.
- Watch for bulk data leaving the network. Claims of 300 GB stolen mean large transfers that should be visible. Alert on unusual outbound volume, new cloud storage destinations, and archive or compression tools running on file servers.
- Prepare your notification process now. The Turbo Data Systems and Hoag cases show how slow, vague notices erode trust. Know your California Civil Code 1798.82 obligations in advance, and have templates and contact lists ready before an incident.
Sources: devman ransomware group lists sealbeachca.gov on its leak site | How to detect fileless attacks exploiting ToolShell: analyzing the... | California warns all public school students of data stolen in contr... | City of Seal Beach and Seal Beach Police Department targeted by Qil... | Caltrain Vendor Turbo Data Systems Reports Data Breach | Hoag Hospital Newport Beach Patients' Personal and Health Data May... | Millions of California students’ sensitive data stolen in breach M... | Data, on the House The Breach Brief