Long Beach Data Breach Exposed SSNs and Biometric Data, City Waited 17 Months

The City of Long Beach has finally publicly disclosed a significant data breach that occurred in November 2023—approximately 17 months after the incident. The city stated that the delay was due to the complexity and duration of a forensic investigation, which concluded in March of this year.

The breach exposed a wide range of sensitive personal information, including Social Security numbers, government-issued IDs such as driver’s licenses and passports, biometric data, dates of birth, medical information, financial account details, and credit or debit card numbers. Not all affected individuals had every type of data compromised.

City officials began sending out notifications in April 2025 and launched a dedicated hotline and multilingual FAQ page to assist residents. Affected individuals have been offered credit monitoring services and identity protection resources. However, officials have cautioned residents not to share personal details over the phone with call center representatives, as staff are not authorized to collect such information.

At this time, the city has stated that there is no evidence the stolen information has been used for fraud or identity theft. Still, cybersecurity experts have criticized the long delay in disclosure, arguing it left residents vulnerable during a critical window when preventative actions could have been taken.

Although the breach involved sensitive data, officials clarified that ransomware was not used in the attack. Nonetheless, the incident highlights growing concerns over municipal cybersecurity preparedness. In response, the city allocated $1 million in its 2025 budget to strengthen its digital defenses.

The city also declared a local emergency in the wake of the breach, allowing for emergency spending and response coordination. During the incident, several digital services were disrupted, including the temporary shutdown of the city’s website. However, critical public safety systems remained operational throughout the response.

The exposure of biometric data is of particular concern amid ongoing privacy debates. Unlike passwords or credit card numbers, biometric identifiers such as fingerprints or facial templates cannot be changed once compromised.

While the total number of affected individuals has not been disclosed, the incident adds to a growing list of cyberattacks on government institutions. Public agencies have increasingly become targets of digital threats due to limited resources and legacy systems. According to data from Spin.AI, the average cost of a ransomware attack in 2024 approached $4.91 million, underscoring the high stakes for public-sector cybersecurity—even when ransomware is not involved.

The City of Long Beach says it is committed to improving data security and transparency going forward. The breach serves as a reminder of the urgent need for timely breach notification, proactive digital safeguards, and comprehensive response planning within municipal government operations.

Sources: Long Beach Local News, Spin.AI, Varutra

—
April 15, 2025 – by Cass Kennedy