El Cajon, CA
rhysida listed this organization on its leak site on Nov 4, 2026.
- Listing date
- Nov 4, 2026
- Attack date
- Nov 4, 2026
Listing text
El Cajon, CA LOT DESCRIPTION (brief) - U.S. municipal dump: police + 911 + production SQLWhat is for sale. Municipal government of a U.S. city (California): police department, 911 dispatch center (joint authority), fire/EMS, all city services, ~1,100+ employees. ~7.8M files / ~7.8 TB. Content current through late September 2026 - SQL backups, payroll runs and 911 logs up to the final days. Live dump, not an archive. Full snapshot: entire file server, restricted police shares, the 911 center, production databases, workstation backups and terminal-server profiles.Contents. Employee home profiles �195 (~800 GB) � department shares - HR/city attorney/finance/council (~1.3 TB) � public works + utility billing for ~250K accounts (~1.3 TB) � citywide share with W-2s for all employees (~2.4 TB) � restricted police archive (~1.7 TB) � 911 center: ~6.3M call recordings over ~3 years + caller phone/address/GPS metadata (~380 GB) � SQL backups (~440 GB: dispatch CAD 17+ GB, evidence vault, crime lab, RMS, access control, MFA server).Credentials and access (sells first). Bank ACH private key + passphrase, state treasury pool PINs, corporate cards with PAN+CVV+PIN � root/enable on the network core (incl. traffic lights) � government accounts (FBI, DEA, state DOJ, CJIS, LiveScan) + 111 officer passcodes to the narcotics system � DMV certificate + password � MFA server dump (TOTP secrets, hardware-token seeds, VPN) � password templates/defaults, vendor ERP backdoor � cameras on public IPs � 13� .pfx signing certs, OAuth secrets, door/access control, map of 401 cameras, gate codes.Personal data. W-2s for all ~1,100 employees (SSN+salary+address) � applicant SSN sets � thousands of EMS patient records with SSN � 337 DMV records � credit dossiers with IRS transcripts � home addresses of the mayor and council � 911 caller GPS metadata (above) � production CAD: ~89K incidents, ~3.9K arrests, 941 warrants, 8.3K SSNs.Police kompromat. Internal Affairs master tracker (1,016 rows / ~10 years, named: use of force �239, pursuits �172, claims �223) + 25-year legacy archive (force �998, complaints �2,612) � DA 'untruthful officers' list � registry of 691 destroyed discipline files + litigation hold list � officer DUI/DV (arrests; victim of an untaken DV call later killed) � fresh 2025�26 cases (negligent discharge + lies � 58-min discipline audio included; fabricated pursuit; theft during arrest) � undercover unit rosters, named + informants (names/DLs/phones) � cold cases (suspects/witnesses) � SWAT callout sheets with personal cell phones � 81 real warrant templates with witnesses � CI/surveillance playbooks � 911 data fed to federal immigration agencies + active court fight with the state AG over surveillance data sharing � county election-office correspondence, PRA packages, protest recordings with caller numbers.Finance/mail. ~77 GB of email archives (HR investigations ~37 GB) � 13 years of payroll � grants � 4 layoff waves � asset forfeiture case files � GIS/document-system credentials.Buyers. Extortion crews (headline-ready topics already in the news cycle) � fraud (W-2/SSN/medical) � IABs (live access to a city 911/CAD is a rare lot) � plaintiffs' attorneys (new suits, case reviews) � media (ready stories) � intelligence services (undercover rosters, informants, LE-systems access) � criminals (sources and witnesses).Deal formats. Full lot exclusive � credentials package (<1 GB, samples before deal) � PII packs by class � police package for media/negotiation � first-publication rights. Freshness: A=2026 (live data), B=2024�25 (active cases), C=25+ year legacy (pattern proof).Limitations. Some containers are encrypted (passwords not recovered), video archives unreviewed; the data contains live police sources - handle with care. More
About the group
rhysida posted its first listing on Jun 5, 2023 and has listed 340 organizations to date.
Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads. The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development. The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin. After encryption, the ransomware appends the extension '.ryshida' to encrypted files.
Learning center
What does this listing mean?
Ransomware groups move data out of the organization before encrypting systems and threaten to publish it if the ransom is not paid. This method is called double extortion.
The listing shows that the group claims to have targeted the organization. Whether the data was published is shown by the later status of the listing.
What should you do if your organization is listed on a leak site?
- Record the listing and any published sample files; do not visit the leak site from the corporate network.
- Isolate affected systems and preserve logs without deleting them.
- Determine which data left the organization; if personal data is involved, review notification obligations with your legal team.
- Make any decision about the ransom demand together with legal, management and incident response.
- Do not bring systems back online before the attacker’s entry point is closed.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainIntelligence 360
Customer intelligence on top of Infostealer Detection: leaked accounts of end users who sign in to your site.