City of El Cerrito data breach: the 2023 LockBit claim and the letters that followed in April 2024

Was there a City of El Cerrito data breach in 2025 or 2026?

Not in the records checked on November 11, 2026. California's breach list has one notice under the name El Cerrito: the city's, with breach dates of June 1 and June 7, 2023 and a reported date of April 12, 2024. Indiana's 2026 breach report has no El Cerrito row. So the 2023 incident is the one the city's own filing describes.

Was El Cerrito hit by ransomware?

LockBit claimed it, but the city's account was of data theft, not locked systems. On August 9, 2023, the LockBit gang added El Cerrito to its leak site with 14 other victims, The Record reported the next day. A city spokesperson told The Record that the city's systems were fully working and that it was not locked out of any devices or data. The city said it was working with outside cybersecurity specialists and law enforcement to test the claim, and would notify anyone whose sensitive information turned out to be affected.

The letter the city later filed with California does not use the word ransomware. It says the city found suspicious activity in its network, secured the network, and opened an investigation with a cybersecurity firm.

What happened, and when?

Date	What happened	Source
June 1 to June 7, 2023	Unauthorized access to city folders with personal information	City letter; California list
August 9, 2023	LockBit adds the city to its leak site	The Record
August 10, 2023	City says its systems are working and it is checking the claim	The Record
March 28, 2024	City finishes finding addresses and checking details for the letters	City letter
April 12, 2024	Notice recorded by California	California list

From the last day of access to California's record took 310 days. The city's letter explains part of that: after the incident it reviewed the files in the affected folders, then spent time finding addresses, and finished that step on March 28, 2024. The notice-delay guide shows how that compares with other notices.

What information was involved in the El Cerrito breach?

Each letter names the person's own data. The sample filed with California says a file contained the recipient's name and a placeholder for the other data elements, so the list varies by person and the public copy does not show it. The city has not published a combined list.

How many people were affected?

The city has not said, and California's record gives no count. No other state record checked for this entry lists the city.

What did El Cerrito offer people who got a letter?

A complimentary one-year membership in Experian IdentityWorks Credit 3B, which includes credit monitoring of all three bureaus, identity restoration help and up to $1 million of identity theft insurance. The letter gave a call line, 888-681-0983, Monday to Friday, 6:00 a.m. to 6:00 p.m. Pacific time, and was signed by the assistant city manager. The enrollment codes from an April 2024 letter will have expired by now. A free credit freeze with Equifax, Experian and TransUnion is still open to anyone; the guide to credit monitoring offers explains the rest.

Other California city attacks in the log

El Cerrito's was one of several California city incidents in 2023. The City of Modesto entry covers the Snatch attack on its police department earlier that year, and the local government breach notice guide covers what Foster City and other cities told residents in 2026.

What the record leaves open

• How many people received letters, and what data each group had in the file.
• How the intruder got into the city's network.
• Whether LockBit published any El Cerrito files, or asked for a ransom.