LockBit ransomware attack disrupted SEIU Local 1000 in California

Service Employees International Union Local 1000, which represents close to 100,000 California state employees across more than 2,000 worksites, confirmed in early February 2024 that it had been hit by a ransomware attack.

The union said it experienced a network disruption caused by an outside actor on January 18, 2024, and subsequently learned the disruption was caused by certain data being encrypted. The LockBit ransomware group posted the union on its dark web leak site the following day and claimed to have taken 308GB of data, including employee Social Security numbers, salary information and financial documents.

Local 1000 described the incident as a criminal cyber act and said it was assisting law enforcement while working with an outside cyber forensics firm to establish what had actually been taken. The union said it would notify anyone whose information turned out to be involved and would provide free credit monitoring and identity theft protection.

Operations were disrupted but not halted. The union said it reopened its call center quickly and that bargaining, grievance handling and other core functions continued. As of mid-February 2024 the scale of the theft rested on LockBit's own claim and had not been independently confirmed, and the union had not said publicly whether a ransom was demanded or paid.