Analyst assessment
Cucamonga Valley Water District experienced a confirmed ransomware incident that disrupted telephones and payment services in August 2024. Its official recovery notice identifies an Aug. 15 network disruption and says phones and phone payments were affected. Water distribution continued on a separate network.
A later original breach notice, dated June 30, 2025, identifies unauthorized access to information on the district’s network from July 31 through Aug. 15, 2024. This extends the documented access window before the outage. The notice does not expressly confirm copying of data, and its redacted sample does not expose all affected information categories.
Operational significance
Contemporaneous reporting reproduced by Maven’s Notebook attributes the return of telephone payments on Aug. 26 to a district spokesperson. That milestone concerns the payment channel. The later district account says all systems were restored within weeks, providing a broader recovery finding without an exact final date.
The incident demonstrates disruption to a utility’s customer-service functions while water distribution remained available. The district also said its separately hosted customer database was not involved. That distinction does not establish that no other personal information held on the district’s own network was accessed, as the later notification illustrates.
Confidence and uncertainty
Confidence is high in the cyberattack, ransomware classification and service disruption because the district confirmed them. Its recovery notice explicitly says it did not pay a ransom. The June 2025 notification provides additional primary evidence of unauthorized access and offers monitoring, but it does not establish realized identity fraud or a numerical affected population.
Fog attribution remains low confidence. The claim tracker lists the district and its domain with a claimed 41 GB; it discovered the listing Oct. 25, 2024. That discovery date is neither a verified original posting date nor evidence of another intrusion. Reviewed victim notices do not confirm Fog’s responsibility, the claimed volume or publication of that material.
Analytic gaps
The initial access method, precise compromised-system inventory, encryption scope and complete data impact remain unverified. The district’s ransomware finding does not independently establish an inventory of encrypted files. The exact first public organizational announcement is also unresolved; the verified dated reproduction of its spokesperson’s account was available Aug. 28.
The incident is resolved on the district’s affirmative account that all systems were restored within weeks. No exact final restoration date is asserted. Aug. 15 remains the latest precisely dated disruption observation in the district’s dated account; the later recovery account, October claim discovery and June 2025 notification do not establish continuing service interruption on those publication dates.
