Summary
- Environment: Municipal network and stored files
- Operational impact: Nonemergency services paused at the March 19 disclosure
- Financial impact: No incident cost established in the reviewed evidence
- Record status: Developing record. Reviewed October 16, 2026; updated as evidence emerges.
What happened
Foster City identified ransomware on its network early on March 19, 2026. [2]
Its later notification says an unauthorized party accessed city systems and may have viewed or acquired files between February 28 and March 25. [1]
Impact
On March 19, the city reported that public services outside emergency response were temporarily paused; 911 and police dispatch remained functional. [2]
The city completed its personal-information review on August 6. Its public template identifies names but leaves the additional affected data fields blank. [1]
The reviewed evidence does not establish an affected-person count or when all services were restored.
Timeline
Ransomware publicly disclosed
The city reported ransomware and paused nonemergency services. See the source notice.
[2]Personal-information review completed
The city completed its review of potentially affected files. See the source notice.
[1]Briefing updated
This briefing was last reviewed and updated on October 16, 2026.
Threat Group & Attack Vector
The city identified ransomware but did not identify the entry method or a responsible group in the reviewed notices. [2]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
The city secured systems, engaged an independent forensic firm and notified law enforcement. It offered one year of credit monitoring and said it had no evidence of identity theft or fraud from the potentially affected information at notice time. [1]