Hayward, CA notifies residents of data breach that compromised SSNs, credit cards, and medical records

The city of Hayward, California last week confirmed it notified an undisclosed number of people about a July 2023 data breach that compromised the following info:

• Social Security numbers
• Medical records
• Financial account info
• Driver’s licenses
• Credit and debit card numbers

The city says it suffered a ransomware attack, but no ransomware group has claimed responsibility as of time of writing. Officials says the city did not pay a ransom, but gave no explanation as to why it took 18 months to notify victims.

Hayward declared an emergency on July 18, 2023. The attack forced the city to shut down library services, bill payments, and the city’s computer-aided dispatch (CAD) system, which is used by the police and fire departments.

California has not disclosed the number of people notified there yet, but we expect the number of victims to be in the thousands given how many were notified in other states: 785 in Texas, 112 in Massachusetts, and seven in Maine, according to disclosures published by those states’ attorneys general.

“We experienced a security incident on or about July 9, 2023 that involved data theft from our network. After a thorough investigation and extensive review of impacted data, we discovered on December 30, 2024, that the files the unauthorized actor downloaded contained some of your personal information,” Hayward’s notice (PDF) to victims states.

We do not yet know how much ransom was demanded or how attackers breached the city’s network. Comparitech contacted Hayward officials for comment and will update this article if they respond.

Hayward is offering eligible victims 12 months of free identity theft protection via Experian.

Ransomware attacks on US government

Ransomware attacks on local governments can cripple public services including bill payments, access to information, communication with constituents, payroll, permitting, and more. Ransomware locks down computer systems and steals data, forcing organizations to either pay a ransom or face extended downtime, data loss, and putting residents at increased risk of fraud.

Comparitech researchers logged 79 confirmed ransomware attacks on US government entities in 2023, and 86 in 2024.

In 2025 so far, ransomware gangs have attacked the Laramie County Library System and the city of West Haven. Douglas County, GA also recently confirmed it suffered a ransomware attack in November 2024, claimed by Lynx.

About Hayward, CA

Hayward, California is a city of 163,000 people in the San Francisco Bay Area.