Southern California Telephone Company Data Breach Claim (September 2026)
The Akira ransomware group listed Southern California Telephone Company, a California phone and internet carrier, on its leak site on September 15, 2026. In its claim, the group says it will upload "34gb of corporate data" that includes employee passports and W-9 forms, customer phone numbers, contracts and NDAs.
- Organization
- Southern California Telephone Company
- Sector
- Telecoms
- Country
- United States, CA
- Disclosed
- September 15, 2026
- Records affected
- Not disclosed
- Attack type
- Undisclosed
- Threat actor
- Akira
- Status
- Claimed, unconfirmed
- Passports
- W-9 forms
- Phone numbers
- Contracts
- Non-disclosure agreements
- Confidential certificates
This incident is a claim by Akira that has not been confirmed by Southern California Telephone Company. Leak-site listings are sometimes exaggerated, duplicated or wrong. The report is updated when the organization, a regulator or a court filing confirms or disputes it.
- Akira lists Southern California Telephone Company on its leak site and says it will upload 34gb of corporate data soon, per the listing as recorded by ransomware.live. The listing sets no date for the upload.
What Happened
Southern California Telephone Company appeared on the Akira group's leak site on September 15, 2026, according to ransomware.live. The listing says the group "will upload 34gb of corporate data soon" and claims the data includes employee personal information such as passports and W-9s, customer information it describes as phone numbers and other sensitive information, contracts and agreements, NDAs and confidential certificates. It gives no date for the upload and no record count.
On the About page of its website, the company describes itself as a privately held competitive local exchange carrier and public utility, established in 1994 as Wholesale Airtime Inc. and headquartered in Southern California, that sells telephone and internet service to residential and business customers. Its website lists the company's address in Temecula, California.
Akira ransomware actors have hit businesses and critical infrastructure in North America, Europe and Australia since March 2023, according to a joint advisory from the FBI, CISA and international partners, last revised November 13, 2025. The advisory says the group uses a double extortion model, encrypting systems and threatening to leak sensitive information, and puts its ransomware proceeds at about $244.17 million as of late September 2025. The listing does not say whether any of Southern California Telephone Company's systems were encrypted.
What Was Exposed
Per ransomware.live, Akira leak-site listing for Southern California Telephone Company, September 15, 2026, the group claims to hold passports, W-9 forms, phone numbers, contracts, non-disclosure agreements and confidential certificates. No record count has been published.
If the listing is accurate, passports and W-9 forms together give an attacker an employee's identity document and taxpayer identification number, the core inputs for opening credit or filing a fraudulent tax return in that person's name. Customer phone numbers let a caller pose as the carrier and ask for account PINs or payment details.
What to Do If You Are Affected
The full sequence, and what to do in what order, is in what to do after a data breach.
What Is Not Known Yet
Akira's listing does not say how the group reached the company's systems, when any access began, or how many employees and customers the data covers. Whether the data has been uploaded yet, and whether Southern California Telephone Company will notify the people named in it, are open questions.
Sources
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.