A major breach of personal information in Long Beach will likely intensify the debate over the dangers of digital ID systems, as city officials confirmed that a cyberattack in November 2023 led to the exposure of highly sensitive data. The public only learned of the incident in April 2025, following what the city described as a complex and time-consuming forensic investigation.
Although the city reports no confirmed misuse of the stolen information, the breach involved a wide array of personal records. Data accessed included Social Security numbers, biometric identifiers, passport and driver’s license details, dates of birth, medical histories, financial account numbers, and payment card information. The types of compromised data varied among individuals, but the range and sensitivity of the information raise serious concerns.
Among the most troubling aspects of the breach is the exposure of biometric data. Unlike passwords or account numbers, biometric identifiers such as fingerprints and facial scans cannot be changed once compromised. This permanent nature of biometric data highlights the risks of centralized identity systems that rely heavily on unchangeable personal traits.
Long Beach began notifying affected residents in April 2025 and created a multilingual FAQ and a hotline to provide assistance. Credit monitoring and identity protection services have been offered. However, residents have been advised not to share personal information with hotline staff, as they are not permitted to collect sensitive details.
While ransomware was not involved in this incident, the breach did force the city to temporarily disable certain digital services, including its main website. Emergency systems remained functional. The city declared a local emergency to enable quicker response and access to emergency funding.
There was a 17-month delay in informing the public. Residents were denied the opportunity to take timely precautions that might have reduced the risk of fraud or identity theft. The delay also points to broader issues with how municipalities handle data breaches, especially when large digital ID databases are at stake.
In response to the incident, Long Beach has set aside $1 million in its 2025 budget to strengthen its cybersecurity defenses. Public institutions often operate on outdated infrastructure and with limited resources, making them appealing targets for cyberattacks. A 2024 report by Spin.AI estimated the average cost of a ransomware attack to be nearly $4.91 million, underlining the financial and operational strain that cyber incidents can inflict, regardless of whether ransomware is involved.
This breach underscores the inherent risks of digital ID systems. By consolidating sensitive personal information in centralized databases, these systems create valuable targets that, once penetrated, can leave individuals permanently exposed. As governments continue to push digital ID frameworks, the Long Beach case serves as a cautionary tale about the consequences of relying on vulnerable, centralized systems for identity verification and public services.
City leaders have stated their commitment to improving data protection and communication with the public. For many privacy advocates, however, the breach is a stark example of why digital ID systems require deeper scrutiny and why alternative, more privacy-conscious approaches to identity management should be prioritized.
I won’t cooperate.
I won’t meet deadlines.
I won’t pay fines.
I won’t comply.
@EmilyTVProducer is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.
The covidcon contact tracking app is a leading archifuckyouall pattern.