Nearly 500,000 impacted by 2023 cyberattack on Long Beach, California

More than a year after a cyberattack on the government of Long Beach, California, the city is informing residents that information on nearly half a million people was leaked.

In breach notification documents filed in multiple states, the city said 470,060 people had sensitive data accessed by hackers who breached government systems during a cyberattack in November 2023.

The city said it conducted an “extensive” forensic investigation and “manual document review” that lasted until March 18, 2025. The information stolen includes Social Security numbers, financial account information, credit and debit card numbers, biometric information, medical data, driver’s license numbers, passports, tax data and more. 

“This has proven to be an unprecedented event for our organization, and we continue to take this investigation and its findings seriously,” Mayor Rex Richardson said in a statement last week. 

Victims who had Social Security numbers leaked are being offered one year of identity protection services. A call center number has been created for victims who have questions about the incident.

The city filed breach notifications in Maine, Oregon, New Hampshire, Massachusetts, Texas, California and several other states. 

At the time of the incident, the city said emergency services were not impacted but some government systems were taken offline in response to the attack. The city website was down but government email and phones were still available. City officials warned residents that they “may experience some delays with systems and services” and issued a proclamation of emergency. 

No ransomware gang ever took credit for the attack and City Manager Tom Modica claimed there is “no indication of any fraudulent activity as a result of this unauthorized access.”

In an FAQ, the city explained that it took 15 months to complete the investigation because of the “extensive forensic investigation and manual document review.”

“Anyone who has experienced a sophisticated cyber incident knows it is a time-intensive process. We take the security of information very seriously and needed to be sure we were confident in the results of the investigation before making any notifications,” the city said. 

The city said it would not disclose further details of the incident because “sharing such information could expose vulnerabilities that may attempt to be exploited further.”