2025 Syracuse PD — unauthorized file access Jan 10–12; victim notices Mar 2026 (SSNs)
Data compromised
Per city notices and local reporting: personal information of people named in SPD records (files dating back decades), including Social Security numbers for some recipients. City said it is not aware of confirmed misuse; letters issued out of abundance of caution. Sources familiar with Common Council briefing cited as many as ~15,000 people named in compromised files.
Technical writeup
Verified municipal disclosure — incident January 10–12, 2025; victim letters began late March 2026 (syracuse.com, April 2026). Syracuse Police Department identified a security incident affecting its IT systems on or about January 11, 2025, shut systems down for containment, and later determined certain digital files were accessed or acquired without authorization. After forensic review of who was named in those files, the city began mailing IDX-managed notices offering 12 months of credit monitoring; a sample March 27 letter stated an individual’s SSN could have been compromised. City officials briefed the Common Council; sources said as many as about 15,000 people were named in the files (records spanning decades). The city said response costs hit its $250,000 cyber-insurance deductible and that it was not aware of confirmed exposure/misuse for any person. FBI involvement was reported during the initial response window. BreachHistory indexes 15,000 per the Common Council briefing figure cited in local press (not a formal AG headcount).
Root cause
Suspicious network activity; certain digital files accessed or acquired without authorization between January 10 and January 12, 2025 (city/IDX notice summarized by syracuse.com)
References
- https://www.syracuse.com/news/2026/04/letters-sent-to-possible-victims-in-syracuse-police-data-breach-that-cost-city-250k.html
- https://cnycentral.com/news/local/syracuse-police-network-security-breach-raises-concerns-over-compromised-data
- https://www.syracuse.com/crime/2025/01/syracuse-police-investigating-security-incident-that-shut-down-its-computer-system.html