Cal Fresh listed on Termite ransomware leak site

• Ransomware group: Termite
• Country: Canada
• Sector: Agriculture and Food Production
• Announcement date: June 9, 2026

Termite claims data breach at Cal Fresh

The threat group known as Termite has officially listed the California Association of Food Banks' Cal Fresh program on its leak site. According to the announcement made on June 9, 2026, the group claims to have successfully breached the institution's systems and exfiltrated certain data. This development follows a claimed attack date of June 8, 2026, suggesting a rapid transition from initial access to public disclosure.

In many modern ransomware operations, threat actors employ a strategy known as double extortion. In this scenario, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information to use as leverage. By threatening to publish stolen data on public leak sites, these groups aim to pressure the victim into paying a ransom to prevent the exposure of confidential information. This tactic increases the pressure on organizations, as the reputational and legal consequences of a public data leak can be far more damaging than the operational downtime caused by encryption alone.

Details of the claimed leak

The announcement by Termite included a sample document intended to prove the validity of their claims. This shared screenshot appears to represent an internal personnel incident report or a disciplinary record. While the group has not provided specific details regarding the total volume of data stolen or the total number of files compromised, the presence of this sample indicates that the breach may involve sensitive internal documentation.

Based on the information provided by the group, the following types of data are reportedly involved:

• Personnel disciplinary records

No information was provided regarding the specific amount of data, the total file count, or the ransom demand requested by the group.

About Cal Fresh

Cal Fresh is a program associated with the California Association of Food Banks (CAFB). The CAFB is an organization dedicated to ending hunger in California by providing information and application assistance for the CalFresh food assistance program. Since 2003, the association has worked in partnership with various food banks and community organizations throughout the state to support its mission.

Analysis and potential impact

This claim of a data leak poses a significant risk regarding the exposure of sensitive personal data belonging to the institution's employees. The nature of the leaked documents, specifically those appearing to be internal disciplinary or incident reports, could compromise the confidentiality of internal processes and private personnel information. Because the institution is based in the United States, any confirmed data breach may be subject to state-level privacy laws and other relevant regulatory frameworks that govern the protection of personal information.

Publicly available information regarding the Termite group remains limited. However, historical patterns in ransomware operations suggest that such leaks can lead to secondary risks. These include targeted phishing attacks, where criminals use stolen information to craft highly convincing messages to deceive employees, or identity theft, if sufficiently sensitive personal identifiers are exposed. To mitigate these risks, organizations typically undergo rigorous forensic investigations to determine the full scope of the leaked data and to identify the entry point used by the attackers.

For organizations operating in the agriculture and food production sector, maintaining robust cybersecurity defenses is critical. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for staff to recognize phishing attempts. As threat actors continue to target organizations that manage essential social services and food security, the ability to detect unauthorized access and respond to data exfiltration attempts remains a vital component of organizational resilience.