Foster City Data Breach (2026)
The 2026 Foster City data breach was confirmed through an official notice filed with the California Attorney General.
The organization has not published how many were affected, so the incident cannot be placed on this scale.
Exposed Data Types
1- Names
About This Breach
An unauthorized party accessed certain city systems and may have viewed or acquired files containing personal information between February 28 and March 25, 2026; the number of affected people was not publicly disclosed.
Foster City is a municipality in San Mateo County, California. The March attack also disrupted city services; ABC7 described it as a ransomware attack and reported that a local state of emergency was declared.
How Did the Breach Happen?
After detecting suspicious activity in portions of its network, the city secured its systems, notified law enforcement and investigated with an external forensic firm. The review found that an unauthorized party accessed certain systems and may have viewed or acquired files. The initial access method was not disclosed.
What Information Was Affected?
The public notice states that the files contained names and additional personal information that varied by person. The sample letter does not itemize the other data fields, so they are not separately listed as confirmed; notice recipients should rely on the scope stated in their own letters.
What Response Did Foster City Disclose?
The city completed its review of the affected files on June 10 and began sending notices on July 13. Affected individuals were offered 12 months of three-bureau Experian IdentityWorks credit monitoring, and the city said it was evaluating additional technical safeguards.
What Should Affected People Do?
Notice recipients should check the enrollment period in their own letter and monitor credit reports and financial accounts for unfamiliar activity. Links or calls appearing to come from the city should be verified through Foster City's official domain or a confirmed contact channel in the notice letter.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
