City of Pittsburg
City of Pittsburg cybersecurity incident
Summary
An August 2024 cybersecurity incident and defensive shutdown disrupted Pittsburg, California’s council-information access and meeting broadcast. The city later confirmed recovery while continuing a separate review of potentially involved personal information.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Unknown cyber mechanism
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
Data impacts
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Application unavailable
A specific application or software platform became unavailable or unusable.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Customer or public access restricted
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
Pittsburg, California, experienced a confirmed cybersecurity incident in August 2024 that disrupted access to municipal meeting information and broadcasting. The city’s initial statement, reproduced Aug. 23, said it identified a security incident on or around Aug. 18 and engaged outside specialists. Later reporting quoted the city manager saying the city took its system down after an internal alert. The evidence supports an incident and defensive shutdown, while leaving the intrusion method unresolved.
The incident is resolved on the city’s affirmative May 7, 2025, account that it had quickly resolved the incident and secured its network. The city continued reviewing potentially affected information afterward. That distinction does not support an outage lasting until the notification campaign, and the reviewed record does not establish an exact restoration date.
Operational significance
Reporting by Hema Sivanandam, republished by Government Technology, identifies impaired access to the City Council’s agenda and minutes through OnBase Web and the inability to broadcast the Aug. 19, 2024, council meeting live. These were concrete restrictions on access to public proceedings. The city’s Aug. 19 notice confirms that the live broadcast was unavailable and says the meeting was still being recorded for later posting. The evidence does not establish that emergency services stopped.
Our contemporaneous report also described residents reporting utility-billing access problems. Those comments do not establish the extent of a citywide payment outage, an interruption to water delivery or a compromise of every municipal department. The shutdown’s effect on public information access is better supported than those broader service claims.
Confidence and uncertainty
The city’s updated breach notice says information associated with residents, employees and people interacting with departments might have been involved. Categories vary by individual and may include identifiers, financial account information, and medical or insurance information. The city offered eligible individuals monitoring and identity-protection services. These precautions and the notice’s wording do not independently establish encryption, copying of data or public release.
No reviewed evidence identifies a responsible actor or confirms ransomware or extortion. A similarly named ALPHV victim listing identifies a Kansas municipality and a 2023 event; it does not support attribution for this California incident. The city’s separate February 2026 phishing-related payment fraud likewise does not explain the August 2024 disruption.
Analytic gaps
Aug. 18 is the documented discovery and defensive-shutdown date, rather than a verified intrusion onset. The California regulator’s filing lists Aug. 6 and Aug. 18 as breach dates, but the sample notification does not explain the earlier endpoint. Aug. 23 is the earliest directly reviewed public cyber acknowledgment. Aug. 19 remains the latest precisely dated operational effect; later investigation, security improvements and notifications do not extend that clock.
The exact initial-access route, duration of individual service failures, scope of information accessed or copied, and final restoration date remain unresolved. The public sample uses placeholders for recipient-specific information, and the city’s aggregate notice describes possible categories rather than a uniform exposure for everyone. Those limits constrain the data-impact assessment without weakening the confirmed finding that municipal information access was disrupted.
Organizations involved
Impacted locations
Contra Costa County, California
County containing the affected city’s headquarters and municipal operations in Pittsburg, California. This physical-site anchor does not assert disruption of Contra Costa County government.
Pittsburg, California
Physical municipality containing the affected California city government and its City Hall at 65 Civic Avenue. Documented effects concern municipal information systems, council-information access and broadcasting; this site anchor does not assert closure of every city facility.
Administrative jurisdiction of the affected municipal government. This association does not establish an area-wide outage, interruption to water delivery or disruption of every municipal service.
Sources
We reported the city’s cybersecurity incident and an Aug. 19 technical problem that prevented a council-meeting broadcast. We also described residents reporting difficulty accessing utility billing.
The city says technical difficulties prevented the live broadcast of that evening’s council meeting. It says the meeting was still being recorded and that a recording would be posted on its website when available.
Reproduces the city’s Aug. 23 statement that it discovered a security incident on or around Aug. 18, secured systems, engaged outside specialists and notified federal law enforcement.
The city says the incident was quickly resolved and its network secured, while its review of potentially involved information continued. It offers monitoring and identity-protection resources.
Reports that the city shut down systems after an internal alert, impairing access to council agendas and minutes and preventing the Aug. 19 meeting’s live broadcast. It quotes the city’s later statement that the incident was quickly resolved while data review continued.
The city says certain information associated with residents, employees and people interacting with departments may have been involved. The possible categories vary by individual, and eligible people are offered monitoring and identity protection.
The city’s release says its investigation recently finished and certain personal information may have been involved. It describes notification efforts and 24 months of monitoring for eligible individuals.
The city’s sample letter identifies Aug. 18 discovery, Aug. 23 community notification and a May 7 follow-up. It says potentially involved information varies by person and offers 24 months of monitoring and identity protection.
The California regulator identifies City of Pittsburg, California, as the reporting organization, links its sample notice and lists Aug. 6 and Aug. 18, 2024, as breach dates.
See something that needs correction?
Signed-in members can report an error, update, or missing source.