The Office of the Los Angeles City Attorney became aware on March 20, 2026 that an unauthorized party had reached a file-sharing system the office used to transfer litigation discovery to opposing counsel and litigants. The extortion group World Leaks announced the breach the same day. According to posts about the breach, 7.7 terabytes of information were available for download and more than 337,000 files were involved. The Los Angeles Times published on Tuesday, April 7, 2026, and a follow-up on April 10; The Record, TechCrunch and FOX 11 Los Angeles reported on April 8.
The Los Angeles Police Department stated the incident did not involve LAPD systems or networks, and the City Attorney's office stated that no other City applications or systems were involved. Both statements are accurate and both are narrower than they sound. The material at risk was already resident in the discovery system: LAPD personnel records, internal affairs investigative files, witness names, witness interviews, health information and criminal complaints.
In its April 10 follow-up, the Los Angeles Times reported that two sources familiar with the investigation described the system as akin to Dropbox or Google Drive and said access was supposed to be restricted to just authorized users - but that the system was not password-protected, because city officials believed it needed to be accessible to other parties including outside attorneys hired to assist with civil litigation. That gap between stated intent and delivered configuration is the finding this article is built on.
It is not a deliberate policy of open access; it is a control that was assumed and never implemented.
KEY FACTS
- WhatUnauthorized access to and publication of files from a discovery file-sharing system; posts about the breach listed 7.7TB available for download and 337,000+ files
- WhoOffice of the Los Angeles City Attorney, custodian of LAPD litigation material; LAPD officers, witnesses, litigants and criminal defendants are the affected populations
- HowThe Los Angeles Times reported on April 10, 2026, per two sources familiar with the investigation, that the system was not password-protected although access was supposed to be restricted to authorized users; initial access method and system provenance remain unresolved
- DataLAPD personnel records, internal affairs investigative files, witness names, witness interviews, health information, criminal complaints
- ActorWorld Leaks, which announced the breach and is reported by TechCrunch as a rebrand of Hunters International active since January 2025; FBI Los Angeles is assisting per the Los Angeles Times
- ImpactRecords confidential under Penal Code 832.7 published in bulk and unredacted, outside the judicial review that normally governs their release; notification population unquantified
WHAT HAPPENED
The City Attorney's office defends the City in civil litigation, including suits against LAPD and its officers, and prosecutes misdemeanors. Both functions generate material that is confidential by statute and both require producing that material to opposing counsel. The office used a file-sharing system to do it.
The provenance of that system is contested in the record, and the conflict matters. " The Los Angeles Times reported on April 10 that the city created a file-sharing system so attorneys on both sides could access discovery materials, that it was akin to Dropbox or Google Drive, and that it expanded far beyond its initial scope to include records from hundreds of lawsuits. A procured product and a city-built system carry different liability, different maintenance responsibility and different answers to who was accountable for the authentication that was supposed to exist.
This article does not resolve the conflict, and readers should treat "third-party tool" as the office's characterization rather than as settled fact.
On March 20, 2026 the office became aware of the incident. The Record reports the statement said it "became aware of the breach on March 20"; the Los Angeles Times reports World Leaks first announced the breach the same day. Neither is an intrusion date. When the system was first reached, and for how long it stayed reachable, is not established by any source retrieved for this article.
Public disclosure came from outside the city, on a claim that should be attributed rather than asserted. The Los Angeles Times reported that an account administrator said a security researcher first disclosed the breach in a post that had been taken down by Tuesday afternoon. The Times noted that the same operator applauded the hack. That is an interested source describing the origin of the disclosure, and it is not independently confirmed.
Emma Best, founder of Distributed Denial of Secrets, said World Leaks was behind the breach and reviewed some of the data while it was posted on the group's leak site. It was subsequently deleted from that site; TechCrunch reported the reason is unclear. Distributed Denial of Secrets hosts the data.
" The office also said law enforcement was contacted and that external forensic specialists and the City's Information Technology Agency were engaged. " The City Attorney's office said it would notify affected parties once its review was complete.
The characterization of what was in the files is imprecise in a way worth recording. LAPD described the material as coming from previously resolved or settled matters, per The Record; the Los Angeles Times rendered it as closed cases. In its April 7 report the Times identified an internal affairs report it described as from an apparently ongoing case, published in redacted form by the @WhosThatCop account on X rather than surfacing from the dump directly.
The Times' hedge is explained by its own reporting: court filings show the city reached a conditional settlement with the woman on March 20, the same day the theft was revealed, and the matter had been set to go to trial the following week. A conditionally settled case that was days from trial is neither cleanly closed nor cleanly ongoing, and no source resolves it further.
THREAT ACTOR
World Leaks claimed responsibility by announcing the breach on March 20, 2026, per the Los Angeles Times. TechCrunch reports the group has been active since January 2025 and is reportedly a rebrand of Hunters International. Its model is theft and publication rather than encryption: it takes files, threatens release, and posts on a leak site to pressure payment. Emma Best of Distributed Denial of Secrets independently identified World Leaks as responsible and observed the leak-site posting firsthand.
FBI Los Angeles said the agency is aware of the incident, is actively assisting the City Attorney's Office, and is coordinating with partners, per the Los Angeles Times.
No formal technical attribution has been issued by any government agency or security vendor, and no incident-response finding has been made public. No ransom demand, amount, negotiation status or payment decision has been disclosed.
WHAT WAS EXPOSED
Reported as present in the published material:
- LAPD personnel records, described as unredacted
- Internal affairs investigative files
- Witness names
- Witness interviews from criminal investigations and internal probes
- Health information, with the two attributing outlets in conflict over whose
- Criminal complaints, reported as unredacted
- Civil litigation discovery drawn from a large number of lawsuits
A precision point that most coverage has blurred. The available reporting presents these as a list of categories found in the corpus, not as a linkage between them, and no source establishes that witness names were joined to medical records within the files. On whose health information was involved, the two outlets that attribute it disagree: the Los Angeles Times, in the full text of its April 7 report, reported that some files included personal health information of officers; FOX 11 Los Angeles described "sensitive witness health information" without identifying a source.
Several outlets set "witness names" and "medical data" adjacent in a single sentence, and that adjacency has been widely read as a mapping. It is not one, and this article does not treat it as one.
The exposure is severe without that embellishment, and the reason is statutory. Peace officer personnel records and records of complaints against officers are confidential under California Penal Code 832.7. They normally reach a litigant only after a noticed motion and in camera judicial review, in which a judge decides what is relevant and what is released.
Bulk publication routes around that process entirely, putting sustained findings, unsustained allegations and unadjudicated complaints into the open together, without context, unredacted, at the scale of hundreds of lawsuits, and mirrored on a transparency site after removal from the leak site. That alone carries this incident. Witness interviews from criminal investigations carry their own risk regardless of whether medical detail is attached to them.
TECHNICAL FAILURE CHAIN
The Los Angeles Times reported on April 10, on two sources familiar with the investigation, that access to the system was supposed to be restricted to just authorized users, and that it was not password-protected. The stated reason was that officials believed the system needed to be reachable by outside parties including private attorneys assisting with civil litigation. This is the root failure, and its shape matters: nobody decided the contents should be public. External access is an identity problem, and guest accounts, federated login and signed expiring links all deliver it while preserving an authentication boundary.
The Los Angeles Times reported on April 10 that the system expanded far beyond its initial scope and came to include records from hundreds of lawsuits. A tool built for one production became the store for many, and nothing forced a re-evaluation of the access model as the value of the contents grew.
A discovery system is a delivery mechanism and should hold per-matter packages for the life of a production. Hundreds of lawsuits resident in one unauthenticated location meant a single access event yielded the collection rather than a case.
Personnel records and criminal complaints are reported as unredacted. Redaction is applied before material leaves the controlled environment. Where the transfer tier has no authentication, redaction is the only remaining control, and it had not been applied.
LAPD described the files as previously resolved or settled matters. The Los Angeles Times identified a report from a case it called apparently ongoing, in a matter conditionally settled on March 20 and previously set for trial the following week. Whether that file should have been purged is genuinely arguable; that the office could not say precisely what was in the system is not.
The Los Angeles Times reported officer health information among the files. The City is these officers' employer, and employer-held medical information carries a confidentiality duty in California that is independent of any litigation posture.
With no password there is no failed-authentication signal, no anomalous-credential event and no unauthorized-session artifact. Retrieval by an unauthenticated party is indistinguishable from intended use, which is why intrusion detection and egress baselining would not have fired here and why the city learned of this from outside.
INDICATORS OF COMPROMISE
No technical indicators have been published for this incident. There is no CVE, no CVSS score, no named vendor or product, no file hash, no infrastructure and no malware family in any source retrieved for this article. The following are the only identifiers available.
- World Leaks - announced the breach March 20, 2026; identified by Emma Best, Distributed Denial of Secrets
- Hunters International - reported by TechCrunch as the group World Leaks is a rebrand of
- March 20, 2026 - City Attorney's office became aware; World Leaks announced the breach; conditional settlement reached in the matter underlying the published internal affairs report
- Before April 7, 2026 - Claimed initial disclosure by a security researcher, in a post reported as taken down by Tuesday afternoon
- April 7, 2026 - Los Angeles Times publishes
- April 8, 2026 - The Record, TechCrunch and FOX 11 Los Angeles report
- April 10, 2026 - Los Angeles Times follow-up reporting the access-control failure and the system's origin
- File-sharing system reported as not password-protected while access was supposed to be restricted to authorized users, per two sources familiar with the investigation cited by the Los Angeles Times
- World Leaks leak site, subsequently deleted
- Distributed Denial of Secrets, hosting the data
- @WhosThatCop on X, which published a redacted internal affairs report from the material
REGULATORY EXPOSURE
This is a municipal law office in California. The frameworks that apply are state and local. Federal commercial regimes and non-US regimes do not attach, and this analysis does not stretch them to manufacture breadth.
- California Civil Code 1798.29 - Breach notification obligation for state and local agencies whose unencrypted personal information is acquired by an unauthorized person. This is the operative statute, not Civil Code 1798.82, which governs businesses. Under 1798.29(e), an agency required to notify more than 500 California residents from a single breach must submit a sample copy of the notice to the Attorney General, and the trigger is the number of residents notified rather than the number affected. That subsection also provides the sample copy "shall not be deemed to be within" Article 1 commencing with Section 7923.600, which strips the investigation-records exemption from the submission rather than applying it.
- California Penal Code 832.7 - Peace officer personnel records and records of citizen complaints are confidential. Under 832.7(a) they are not subject to disclosure except by discovery pursuant to Evidence Code sections 1043 and 1046, subject to the categories opened by SB 1421 and SB 16. Records outside those categories remain confidential by statute and are now public. This is the center of the exposure.
- California Evidence Code 1043 and 1045 - The Pitchess procedure requires a noticed motion under 1043 and in camera judicial review under 1045 before officer personnel records reach a litigant. Bulk publication bypasses that gatekeeping entirely.
- California Confidentiality of Medical Information Act, Civil Code 56 et seq. - The applicable duty is 56.20(a), which requires each employer that receives medical information to establish appropriate procedures to ensure its confidentiality and protection from unauthorized use and disclosure. The City is the officers' employer and the Los Angeles Times reported officer health information among the exposed files. A private claimant reaching that duty has a remedy at 56.36(b)(1), which provides nominal damages of one thousand dollars and states expressly that it is not necessary that the plaintiff suffered or was threatened with actual damages. Separately, and not available to a private claimant, 56.36(c)(1) allows civil penalties up to two thousand five hundred dollars per negligent violation; 56.36(f)(1) confines that route to a civil action brought in the name of the people of the State of California by the Attorney General, a district attorney, a county counsel, a city attorney or a city prosecutor. The office named in that enforcement list is, here, the breached party. Two limits apply. The recipient duty at 56.13 is a weaker fit, because records obtained through litigation arrive under the disclosure routes at 56.10(b)(1) and 56.10(b)(3), court order and discovery process, rather than under a patient authorization, and a city law office is not a "contractor" as defined at 56.05. More fundamentally, 56.05(j) defines medical information as information in possession of or derived from a provider of health care, health care service plan, pharmaceutical company or contractor. Officer health data obtained in litigation discovery falls within the CMIA only if it traces to one of those four origins, and nothing in the available reporting establishes that it does.
- HIPAA - Does not attach. The definition of protected health information excludes employment records held by a covered entity in its role as employer, and the City Attorney's office is not acting as a covered entity or business associate when it holds medical records obtained through litigation discovery. The harm is real; the federal hook is not, and citing HIPAA here would be wrong.
- California Consumer Privacy Act / CPRA - Does not apply. The CCPA regulates "businesses." A municipal public agency is not one.
- California Government Code 7923.600(a) and 7927.705 - Exemptions for records of investigations and for records exempt under other law. These are the current provisions. The frequently cited Government Code 6254(f) and 6254(k) ceased to be operative on January 1, 2023 under AB 473, Stats. 2021, Ch. 614, which recodified the Public Records Act into Division 10 commencing with Section 7920.000 and added Government Code 6276.50 to sunset the former scheme rather than repealing the section outright. Citing 6254(f) or 6254(k) today cites superseded law.
- California Penal Code 1054.2 - Restricts an attorney from disclosing to a defendant the address or telephone number of a victim or witness disclosed in criminal discovery. Subdivision (c) extends the restriction to identifying information as defined by Penal Code 530.55, which sweeps in the Social Security number, driver's licence number and date of birth, other than the name and place of employment of the victim or witness. The names themselves therefore sit outside this restriction. The provision protects the identifiers attached to a witness, not the fact of the witness's identity.
- California Government Claims Act, Government Code 810 et seq. - Governs tort claims against public entities. Claims from officers, witnesses and litigants proceed through this route, subject to the immunity analysis applicable to public entities.
- Federal securities, FTC and financial-sector regimes - Not applicable. There is no issuer, no commercial entity and no financial institution here.
- GDPR, UK GDPR, Saudi PDPL, UAE PDPL - Not applicable on these facts. The affected populations are Los Angeles officers, witnesses and litigants.
INTELLIGENCE GAPS
The City Attorney's office calls it a third-party tool; the Los Angeles Times reports the city created it. No vendor or product has been named by anyone. This determines whether liability runs to a supplier or sits entirely with the City, and it is the most consequential open question.
March 20, 2026 is the date the office became aware and the date the group announced. When the system was first reached, by whom, and for how long it stayed reachable, is not established.
The Los Angeles Times attributes the figures to "posts about the data breach": 7.7 terabytes available for download and more than 337,000 files. The Record renders it as 7.7TB available for download and 337,000+ files accessed. Neither is a verified exfiltration total, no official confirmation has been issued, and no count of affected officers, witnesses or litigants has been published, so the Civil Code 1798.29(e) threshold of 500 residents notified cannot be assessed.
The Los Angeles Times attributes health information to officers; FOX 11 Los Angeles attributes it to witnesses without sourcing. The officer attribution appears only in the full text of the April 7 Times report. At least one widely syndicated reproduction, Police1's, is a re-edited cut rather than a truncation: it carries the category list without the attributing sentence, drops the conditional settlement and the FBI statement, and misrenders the X account as @WhosTheCop. Analysis derived from that version reports a witness linkage no source states, and returns false negatives on facts the original contains.
The Los Angeles Times reports that every officer's personnel records are contained within a system called TEAMS II. No source states TEAMS II was accessed. Whether the published personnel material originated there and was copied into the discovery system is unstated, and LAPD's position is that its systems were not involved.
No demand, amount, negotiation or payment has been disclosed, and the removal of the data from the World Leaks leak site is unexplained.
The claim that a security researcher first disclosed the breach comes from an account administrator whom the Los Angeles Times reports applauded the hack. The account is not identified in the material retrieved for this article, and the claim is uncorroborated.
Developments after that date are outside its scope, including Los Angeles Times coverage of the police union withdrawing support for the city attorney and Los Angeles Daily News coverage of a councilmember seeking answers. Neither was retrieved here and neither is relied on above.
ZERO|TOLERANCE Advisory
The distinguishing fact here is that access was supposed to be restricted to authorized users and was not. Assumed controls fail silently. Run authenticated and unauthenticated probes against every system holding case material, on a schedule, and treat the unauthenticated probe result as the only evidence that counts. A policy statement is not a control, and a design intention is not a configuration.
Outside counsel, co-defendants and experts all need access, and every one of those needs is met by federated identity, scoped guest accounts, or signed links that expire on a set date. Write into policy that no system holding case material may be reachable without an authentication boundary, and require named sign-off for any exception.
The system here reportedly grew from one purpose to hundreds of lawsuits without its access model being revisited. Any internally built file-sharing or transfer system should carry a documented purpose, a maximum data class and a review that forces re-approval as contents grow. Procurement controls will not catch these, because nothing was purchased.
A package should contain one matter, be reachable only by the counsel entitled to it, and expire on a date tied to the production deadline. Cap resident volume so no single workspace accumulates a collection at this scale. The objective is that full compromise of the transfer tier yields one case, not the docket.
Gate the external transfer tier so unredacted material cannot enter it: automated detection for personnel record markers, witness identifiers and health terminology, with upload refused rather than flagged. Redaction that depends on someone remembering is redaction that eventually does not happen.
Officer health records carry a confidentiality duty under Civil Code 56.20(a) independent of any litigation use, and they should not sit in a litigation transfer system. Where a production requires them, produce them as a separately controlled package.
The description of the material as previously resolved or settled was offered without an inventory capable of supporting it, and reporting located a file that did not fit the description. Maintain a queryable index of transfer-system contents by matter and status, purge closed matters automatically, log deletions, and query the index before any public statement about scope.
With no password there is no failed-login signal and no anomalous-session artifact, so intrusion detection and egress baselining would not have fired. The control that fits this failure is continuous external attack surface scanning of your own address and domain space for unauthenticated services, reviewed by someone empowered to take a system offline. Outsiders found this before the City did.
Credit monitoring is the standard remedy and it is the wrong one for an officer whose disciplinary record is public, or for a witness named in a criminal investigation file. Identify those subsets first and coordinate with LAPD, the District Attorney and victim services on a response matched to the actual harm.
SOURCES
Los Angeles Times, "Trove of sensitive LAPD records leaked in data hack of city attorney's office," Libor Jany and Richard Winton, April 7, 2026, updated April 8, 2026 - https://www.latimes.com/california/story/2026-04-07/lapd-records-suspected-hack
Los Angeles Times, "How thousands of sensitive LAPD files got leaked online, and what happens next," Richard Winton and Libor Jany, April 10, 2026, updated April 11, 2026. Source for the access-control failure, the system's origin and scope expansion, and TEAMS II - https://www.latimes.com/california/story/2026-04-10/lapd-sensitive-files-leak-explained
Access note: the two Los Angeles Times reports above are paywalled. Full text consulted via syndication at spokesman.com and govtech.com (April 10) and yahoo.com (April 7).
The Record from Recorded Future News, "Breach exposes sensitive LAPD files stored in city attorney system," April 8, 2026 - https://therecord.media/breach-exposes-lapd-files-city-attorney-systems
TechCrunch, "Hackers steal and leak sensitive LAPD police documents," April 8, 2026 - https://techcrunch.com/2026/04/08/hackers-steal-and-leak-sensitive-lapd-police-documents
FOX 11 Los Angeles, "LAPD data breach: Thousands of confidential police records leaked in city attorney hack," April 8, 2026 - https://www.foxla.com/news/apd-data-breach-city-attorney-leak-investigation
Distributed Denial of Secrets, statements by founder Emma Best as reported by TechCrunch
Office of the Los Angeles City Attorney, statements by Ivor Pine, Deputy Director of Communications, as reported by The Record and FOX 11 Los Angeles
Los Angeles Police Department, departmental statement as reported by The Record, TechCrunch and FOX 11 Los Angeles
FBI Los Angeles, spokesperson statement as reported by the Los Angeles Times