WorldLeaks Ransomware Group Breaches City of Los Angeles

Attacks also disrupt services in Bay Area cities as cybercrime group shifts tactics

Mar. 21, 2026 at 5:34pm

Got story updates? Submit your updates here. ›

The WorldLeaks ransomware group has breached the City of Los Angeles, claiming to have stolen 159.9 GB of data. This comes as the group also hit the Metro system in Los Angeles, forcing a shutdown, and carried out attacks in the Bay Area that led to emergency declarations in Foster City and other cities.

Why it matters

The WorldLeaks group has emerged as a major cybercrime threat, shifting from traditional ransomware attacks to a focus on data theft and extortion. These incidents highlight the growing risk municipalities face from sophisticated cybercriminal organizations and the potential for widespread disruption to critical public services.

The details

According to reports, the WorldLeaks group breached the City of Los Angeles and claimed to have stolen 159.9 GB of data. In a separate incident, the group's attack on the Los Angeles Metro system forced the transit agency to limit access to its internal systems, disrupting station arrival displays. Meanwhile, officials in Foster City declared a state of emergency after a ransomware attack widely disrupted municipal services, though core emergency response remained intact. Authorities are still investigating whether sensitive data was accessed or copied in the attacks.

  • On March 20, 2026, the WorldLeaks ransomware group added the City of Los Angeles to its data leak site.
  • On March 21, 2026, the unauthorized activity hit Metro's internal systems in Los Angeles, forcing the agency to limit access.
  • On March 21, 2026, officials in Foster City declared a state of emergency due to a ransomware attack disrupting municipal services.

The players

WorldLeaks

An extortion-focused cybercrime group that steals company data to pressure victims into paying, threatening public leaks if they refuse. The group emerged in 2025 after rebranding from Hunters International, a ransomware gang active since 2023.

Los Angeles Metro

The public transportation system serving the Los Angeles metropolitan area, which was hit by the WorldLeaks group's attack, forcing the agency to limit access to its internal systems.

Foster City

A city in the San Francisco Bay Area that declared a state of emergency after a ransomware attack widely disrupted municipal services.

Got photos? Submit your photos here. ›

What’s next

Authorities in Los Angeles and the affected Bay Area cities are working with cybersecurity experts to investigate the attacks, restore operations, and determine if any sensitive data was compromised. Law enforcement is also likely to intensify efforts to track down and disrupt the WorldLeaks group.

The takeaway

These incidents underscore the growing threat posed by sophisticated cybercrime groups like WorldLeaks, which have shifted their tactics to focus on data theft and extortion. Municipalities must prioritize robust cybersecurity measures and incident response plans to protect critical public services from such disruptive attacks.