WorldLeaks ransomware group breached the City of Los Angels

WorldLeaks, an extortion-focused ransomware group, claimed on 20 March 2026 that it had breached the City of Los Angeles and its Metro system, adding the city to its data leak site and stating it had stolen 159.9 GB across 779 files. According to NBC Los Angeles, the incident led Metro to restrict internal computer-system access, resulting in station monitors not displaying arrival times while services continued to run.

The breach also disrupted some customer-facing functions, with riders unable to add funds online or via support and being advised to use ticket machines. In a separate development, Foster City reported a ransomware disruption to municipal services that prompted a state of emergency declaration in the area, though emergency services such as 911 remained operational.

The City of Los Angeles breach underscores WorldLeaks’ shift from encryption to data theft and extortion, a pattern the group has described as pressuring victims to pay to avoid public releases.