--- title: "Foster City ransomware and data incident" description: "Foster City disclosed ransomware disruption and possible personal-information exposure after a February–March 2026 network intrusion." incident_type: "Ransomware" status: "active" last_modified: "2026-10-16" canonical_url: "https://www.ally.security/incidents/foster-city-ransomware-data-incident-2026" markdown_url: "https://www.ally.security/incidents/foster-city-ransomware-data-incident-2026.md" stix_url: "https://www.ally.security/incidents/foster-city-ransomware-data-incident-2026/stix.json" --- # Foster City ransomware and data incident Foster City identified ransomware on its network early on March 19, 2026. Last modified Oct 16, 2026 · 2 sources ## Summary - **Environment:** Municipal network and stored files - **Operational impact:** Nonemergency services paused at the March 19 disclosure - **Financial impact:** No incident cost established in the reviewed evidence ## What happened [Foster City](https://www.fostercity.org/) identified ransomware on its network early on March 19, 2026. [2](#source-2) Its later [notification](https://oag.ca.gov/system/files/ELN-28528%20Foster%20City%20-%20Adult%2012%20months%20CM.pdf) says an unauthorized party accessed city systems and may have viewed or acquired files between February 28 and March 25. [1](#source-1) ## Impact On March 19, the city reported that public services outside emergency response were temporarily paused; 911 and police dispatch remained functional. [2](#source-2) The city completed its personal-information review on August 6. Its public template identifies names but leaves the additional affected data fields blank. [1](#source-1) The reviewed evidence does not establish an affected-person count or when all services were restored. ## Timeline ### March 19, 2026 — Ransomware publicly disclosed The city reported ransomware and paused nonemergency services. See the [source notice](https://www.fostercity.org/m/newsflash/home/detail/245). [2](#source-2) ### August 6, 2026 — Personal-information review completed The city completed its review of potentially affected files. See the [source notice](https://oag.ca.gov/system/files/ELN-28528%20Foster%20City%20-%20Adult%2012%20months%20CM.pdf). [1](#source-1) ### October 16, 2026 — Briefing updated This briefing was last reviewed and updated on October 16, 2026. ## Threat Group & Attack Vector The city identified ransomware but did not identify the entry method or a responsible group in the reviewed notices. [2](#source-2) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response The city secured systems, engaged an independent forensic firm and notified law enforcement. It offered one year of credit monitoring and said it had no evidence of identity theft or fraud from the potentially affected information at notice time. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Foster City notice of data breach filed in October 2026 official · City of Foster City ### Foster City Services Impacted by Cyber Security Breach official · City of Foster City · Mar 19, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** Foster City ransomware and data incident: Its later notification says an unauthorized party accessed city systems and may have viewed or acquired files between February 28 and March 25. 2. **Resulted In · 100% confidence · current** Foster City ransomware and data incident: Personal-information review completed 3. **Resulted In · 100% confidence · current** Ransomware publicly disclosed: The city reported ransomware and paused nonemergency services. 4. **Occurred At · 100% confidence · current** Ransomware publicly disclosed: 2026-03-19 5. **Resulted In · 100% confidence · current** Foster City ransomware and data incident: The city secured systems, engaged an independent forensic firm and notified law enforcement. It offered one year of credit monitoring and said it had no evidence of identity theft or fraud from the potentially affected information at notice time. 6. **Discovered At · 100% confidence · current** Foster City ransomware and data incident: 2026-03-19 7. **Occurred At · 100% confidence · current** Personal-information review completed: 2026-08-06 8. **Affected Organization · 100% confidence · current** Foster City ransomware and data incident: City of Foster City 9. **Resulted In · 100% confidence · current** Foster City ransomware and data incident: Ransomware publicly disclosed 10. **Disclosed At · 100% confidence · current** Foster City ransomware and data incident: 2026-03-19 11. **Resulted In · 100% confidence · current** Foster City ransomware and data incident: The city completed its personal-information review on August 6. Its public template identifies names but leaves the additional affected data fields blank. 12. **Resulted In · 100% confidence · current** Foster City ransomware and data incident: Foster City identified ransomware on its network early on March 19, 2026. 13. **Resulted In · 100% confidence · current** Foster City ransomware and data incident: The city identified ransomware but did not identify the entry method or a responsible group in the reviewed notices. 14. **Resulted In · 100% confidence · current** Personal-information review completed: The city completed its review of potentially affected files. 15. **Resulted In · 100% confidence · current** Foster City ransomware and data incident: On March 19, the city reported that public services outside emergency response were temporarily paused; 911 and police dispatch remained functional.