Skip to main content
Darkfield

VictimsCalifornia Association of Food Banks (CAFB)

California Association of Food Banks (CAFB)

listed as Cal Fresh

claimed by TermiteAgriculture and Food ProductionCanadalow · The leak post contains only generic program …
Track this organisationReport a correction
What this is

A claim by the operator that it has published the data.

No statement from the organisation is on record here. We index the listing; we never host the data.

Corroboration
not recorded

This row predates provenance tracking; the next feed run will stamp it.

Timeline
  1. Listed · Jun 9, 2026
  2. Data published · date unknown: the post does not say
Leak-post captureJun 9, 2026post text missingscreenshot missingverified missing
No screenshot on file. This row comes from a tracker listing; our crawler has not captured the page yet.
Posthttp://termiteuslbumd…onion/post/6a27543ec684b738d525bc1d
What the operator wrote
The California Association of Food Banks (CAFB) is committed to ending hunger in California and aims to provide clear, up-to-date information about CalFresh for people who are interested in applying. Since 2003, CAFB has partnered with food banks and other community-based organizations throughout the state to educate consumers about CalFresh and provide application assistance.

From the feed's summary of the post; we hold no capture of our own yet.

Size claimed
unknown
the post states no size
Records claimed
unknown
the post states no count
Ransom · deadline
not stated
we show unknown, never zero
Data the operator says was taken
CalFresh application informationConsumer education materialsPotentially beneficiary or applicant records

Extracted from the post text by the enrichment model; each item traces to a sentence in the capture.

Attack summary

The ransomware group 'termite' claims to have attacked CAFB. The group's post references CalFresh program information, but does not explicitly state whether data was exfiltrated, encrypted, or both, nor what specific data is at stake.

Severity low: The leak post contains only generic program information and partnership descriptions with no explicit claims of data exfiltration, encryption, operational disruption, or proof files/screenshots. No ransom demand stated. Insufficient evidence of actual breach or impact.

If this is your organisation
  1. Assume credentials were taken even where the post names none: reset, revoke sessions, enforce a second factor.
  2. Open the incident with CCCS and your regulator before data is published, not after.
  3. Watch the listing: a tracked domain is re-checked against every new post and you are paged when this one changes status or another operator names the organisation.

Method: the row comes from the operator's post, listed by an independent tracker and checked against our own Tor capture of the leak site. We publish the listing, the screenshot and the claim text; we do not download, host or redistribute leaked data. A post that changes is re-captured and this page updates.

Updated 4 months ago

Disclosure context

About Termite

Termite is a recently emerged ransomware group that first appeared in November 2024, operating with apparent financial motivations based on their targeting patterns across multiple high-value sectors. The group's origin and affiliations remain largely undocumented by major threat intelligence providers, though their targeting of primarily Western nations including the United States, France, United Kingdom, Germany, and Canada suggests a non-Western operational base. With 39 documented victims across healthcare, telecommunications, business services, and technology sectors within just a few months of operation, Termite demonstrates an aggressive deployment strategy, though specific details regarding their initial access vectors, encryption methodologies, and whether they employ double or triple extortion tactics have not been publicly documented by established security research organizations. The group's relatively recent emergence means that notable high-profile campaigns and specific technical indicators have not yet been extensively analyzed or reported by authoritative sources such as CISA, FBI, or major cybersecurity firms. Termite appears to remain active as of early 2025, though the limited public documentation suggests they may be a smaller-scale operation or have not yet attracted significant attention from major threat intelligence organizations. The group has been linked to 58 public disclosures across our corpus. First observed on a leak site on November 17, 2024; most recent post October 9, 2026. The operation is currently active.

Timeline of this disclosure

  • June 9, 2026Cal Fresh listed by Termite on the group's public leak site

Other recent disclosures by Termite

Termite has been linked to 58 public victims on Darkfield. A sample of the most recent:

See the full Termite dossier →

Sector and geography

This disclosure adds to ransomware activity in the Agriculture and Food Production sector, which has 786 disclosures indexed across all operators we track. Geographically, Cal Fresh is reported in Canada, a country with 324 ransomware disclosures in our corpus.

If your organisation is affected

A listing by Termite means Cal Fresh appeared on a ransomware extortion site and data attributed to it has been published. If this is your organisation, or a supplier you depend on, the priority is to confirm the intrusion and contain it before the window to act closes.

  • Engage your incident-response team and preserve forensic evidence before remediating — do not wipe affected systems first.
  • Force a password reset and revoke active sessions for exposed accounts; rotate any credentials, API keys or certificates that may have been in the stolen data.
  • Assess regulatory notification duties (GDPR, NIS2, sector regulators) — many carry a 72-hour reporting clock from awareness.
  • Report the incident to your national CERT, CCCS (Canada), as required for your jurisdiction.
  • Monitor for the data appearing on Termite's leak site and across paste and breach channels, and brief downstream partners who may be exposed through you.

How we know this. Darkfield monitors public ransomware leak sites continuously, recording every new disclosure and the moment the operator says the data was released. Each entry on this page is sourced from the operator's own publication, listed by an independent tracker (RansomLook) and checked against our own capture. We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.

Cal Fresh data breach — Termite ransomware leak (2026) · Darkfield