City of Santa Paula Hit by Ransomware Attack Claimed by Qilin, Government Services Disrupted
Published on November 28, 2025
Key Takeaways
- Attack confirmed: The City of Santa Paula, a government organization in the USA, has reportedly been targeted by the Qilin ransomware group.
- System outage: On November 12, the city acknowledged a significant network outage that affected its email and internal server capabilities.
- Attribution: The Qilin ransomware gang has claimed responsibility for the cyberattack, adding another government entity to its list of victims.
The City of Santa Paula, California, is grappling with the aftermath of a significant cyber incident, reportedly carried out by the notorious Qilin ransomware group. The city first announced it was "currently experiencing a network outage affecting email and internal servers" on November 12.
While the cause was initially unconfirmed by officials, the threat actor has since claimed the city as a victim.
Details of the Cyberattack on Santa Paula
The U.S. city’s initial statement confirmed a widespread government network outage that severely hampered internal communications and access to essential digital infrastructure.
The full scope of the breach and the specific data potentially compromised have not yet been disclosed by city officials.
The Qilin ransomware group, known for its double-extortion tactics, usually exfiltrates sensitive information with the threat of public release if a ransom is not paid.
Response to the Santa Paula Ransomware Attack
The response from the City of Santa Paula will be critical in mitigating the damage. Restoring encrypted systems from backups, investigating the extent of data exfiltration, and securing the network against further intrusion are complex and resource-intensive processes.
This cyberattack on Santa Paula highlights the persistent threat that ransomware poses to public sector entities, which often manage sensitive information and provide essential community services.
The threat actor targeted the City of Sugar Land in October, when it also continued to target health organizations, such as the Shamir Medical Center in Israel and MedImpact. Qilin Ransomware's attack methods recently evolved to include leveraging VPN credentials exposed on the dark web.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular