Cal Fresh Listed by termite Ransomware Group

On June 8, 2026, the Termite ransomware group listed the California Association of Food Banks on its leak site after exfiltrating internal files during a ransomware attack. The organization, which helps Californians apply for CalFresh food assistance and partners with food banks statewide since 2003, now faces public exposure of its internal documents. Anyone who has used CalFresh services, received assistance through CAFB-supported programs, or had their information shared with affiliated food banks could be affected.

Confirmed Facts from Reporting

Public reporting indicates that Termite posted details of the incident on its dark web leak site, accessible via the .onion address tracked by ransomware.live. The group claims to have exfiltrated internal files from the California Association of Food Banks. No specific victim count has been released, and the exact volume or sensitivity of the stolen data remains unclear from available reporting. The listing appeared on June 8, 2026, following the typical ransomware pattern of initial encryption demands followed by public shaming when payment is not made.

Why This Matters for You and Your Family

If your family has ever applied for CalFresh benefits, used a local food bank partnered with CAFB, or provided personal details such as names, addresses, phone numbers, dates of birth, or Social Security numbers to access food assistance, those records may now sit in a ransomware group's hands. Internal files from organizations like this often contain applicant information, case notes, eligibility documentation, and contact details for entire households. Once exposed, this data does not disappear. It circulates among criminals who combine it with other leaks to build profiles that lead to identity theft, fraudulent benefit claims, or targeted scams against you or your children.

The Doxxing and Identity-Chain Implications

Leaked assistance program records frequently include email addresses, phone numbers, and physical addresses that link directly to your online accounts. Criminals use these connections to map your digital footprint across social media, gaming platforms, and shopping sites. A single credential exposed in this breach can unlock email accounts, which then reveal password-reset links for banking, government services, or your children's gaming profiles. Available reporting describes how such chains escalate quickly from data theft to full doxxing, where attackers publish personal details, harass family members, or sell the compiled dossiers on underground markets.

Termite Group's Known Track Record

Public reporting attributes the attack to the Termite ransomware group. The group emerged in recent years and has targeted organizations across multiple sectors with a playbook that includes gaining initial access through common vulnerabilities, exfiltrating data before deploying encryption, and then pressuring victims through public leak sites when ransom demands go unpaid. Notable prior victims listed in industry trackers show a pattern of hitting mid-sized nonprofits, healthcare providers, and local government-adjacent entities. Their extortion style relies on timed deadlines followed by gradual data dumps designed to maximize reputational damage and pressure for payment.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, addresses from assistance programs, and real-world identity so you can see the exposure chains created by this breach.
• Rotate any password you used when applying for CalFresh or interacting with CAFB-affiliated organizations, and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 15.4B+ breach records and 100+ platforms so the next leak that touches your family's data is caught and addressed in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children's gaming accounts, which often become targets when credential leaks cascade into account takeovers and doxxing chains.
• Let remediation specialists handle the follow-up work, including takedown requests across data brokers and monitoring for resale of the stolen CAFB files.

The incident shows how even assistance programs meant to support families can become gateways for long-term identity risk when ransomware groups strike. Taking targeted steps now limits the damage from this specific leak and reduces exposure from future ones. DoxxScan by GalaxyWarden delivers continuous monitoring across 15.4 billion breach records and more than 100 platforms, AI-powered identity-chain mapping that connects handles to real identities, hands-on remediation by specialists, and full household coverage that includes children's gaming accounts. Start your DoxxScan trial today to regain control over what criminals can piece together about you and your family.