The Cybersecurity Threats Hitting Los Angeles Businesses Hardest Right Now

The cybersecurity threats hitting Los Angeles businesses hardest right now are email payment fraud, stolen logins, and ransomware that steals data before it locks anything. California led every state in 2025 cybercrime losses, at $3.67 billion.

A controller at a distributor in Commerce gets an email from a supplier she's paid for 6 years. Same name, same signature block, same thread. The bank changed, it says, so please use the new account for Friday's invoice. She does. The supplier calls 3 weeks later asking where the money went.

That's the face of the cybersecurity threats Los Angeles businesses face in 2026, and it rarely makes the news. Headlines go to ransomware. The money goes somewhere quieter. If you're weighing managed cybersecurity in Los Angeles, the useful question isn't which threat sounds worst. It's which one is actually draining accounts in this state, and the FBI publishes that answer every year.

What do the FBI's California numbers actually show?

California filed 116,414 cybercrime complaints with the FBI in 2025, more than any other state, and reported $3.67 billion in losses. Business email compromise cost 3,444 California victims $430.7 million. Reported ransomware losses were $1.08 million.

Those figures come from the FBI's 2025 IC3 state report for California, built from complaints people and businesses file with the Internet Crime Complaint Center. A few rows matter to a business. The rest are consumer scams.

Look at the ransomware row again. $1.08 million across 438 victims works out to about $2,500 each, which no one who has lived through an attack would believe. The FBI says so itself in the national 2025 report, noting that ransomware losses usually exclude lost business, time, wages, files, equipment, and third-party remediation. Coalition's insurance claims data puts the average ransomware claim at $269,000.

So the table tells you 2 different things. Email fraud is the threat most likely to take money out of your account this year. Ransomware is the one most likely to stop your business from operating, and the FBI's ledger barely registers that cost.

Business email compromise is where LA money actually leaves

Business email compromise, or BEC, means a criminal takes over a real mailbox or fakes one well enough, then asks for money or changes where a payment goes. In California it averaged about $125,000 per reported victim in 2025.

Roughly 14% of the $3.05 billion in BEC losses reported nationwide came from California alone. Insurance data says the same thing from a different angle. Coalition's 2026 Cyber Claims Report found BEC and funds transfer fraud made up 58% of the incidents it handled in 2025, and the average fraudulent transfer cost $141,000. Just over half of those transfer frauds, 52%, started with a compromised mailbox.

LA's economy runs on exactly the kind of payments these crews hunt. Freight forwarders and importers wiring overseas suppliers around the ports. Escrow and title companies moving down payments. Real estate fraud alone cost Californians $42.4 million in the same FBI data. Production companies paying a long tail of vendors on tight schedules. Every one of those runs on an email that says where the money should go.

Nothing in the attack is technical once the attacker is inside the mailbox. They read for weeks, learning who approves invoices, when the big ones land, which vendors get paid by wire instead of check, and how each of those vendors phrases a routine request, so the eventual fake reads exactly like the real thing. Then they set up an inbox rule that quietly moves replies out of sight and send a single, perfectly timed request.

Fixing it is mostly procedure. Cheap procedure, too.

• A written rule that no bank detail changes without a phone call to a number already on file, never the one in the email.
• Email security that flags lookalike domains and alerts when someone adds a forwarding rule to a mailbox.
• MFA (the code or phone prompt after a password) on every mailbox, including the shared ones like accounting@ and ar@.

Our breakdown of the 2 types of BEC the FBI tracks walks through why the call-back rule works when software misses.

Stolen logins and the fake help desk call

Over 97% of identity attacks are password attacks, Microsoft reported in its 2025 Digital Defense Report, and identity-based attacks rose 32% in the first half of 2025 alone. Attackers rarely need to break in when a working password gets them through the front door.

Where do the passwords come from? Old breaches, mostly, plus infostealers, a type of malware that grabs every saved password off a browser, often from a personal laptop someone also uses for work. Microsoft's 2025 Digital Defense Report found criminals now use infostealers as the first step of an attack, not an afterthought. The Record's coverage has the quotes.

MFA stops the bulk of that. Not all of it.

Better-run crews skip the MFA problem by calling your people. The group known as Scattered Spider made this famous, and the FBI and CISA advisory on it, updated in July 2025, describes members calling help desks while posing as employees, getting passwords reset, and having MFA moved to a phone they control. Or the reverse, calling employees while posing as IT. Or simply sending push notification after push notification at 11 p.m. until a tired person taps Approve. Security people call that MFA fatigue.

Picture your outsourced help desk getting a call from someone who knows your CFO's name, title, and that she's traveling this week. Would they reset her account?

That's a real question to put to your provider, and the answer should be a documented identity check, not "we'd use our judgment." For admin accounts, phishing-resistant MFA, meaning a physical security key or a passkey that won't work on a fake login page, is worth the hassle. Conditional access rules in Microsoft 365 that block sign-ins from unknown devices close another chunk of the gap. Our 2026 phishing statistics cover how those fake login pages get built.

Ransomware now steals before it locks

Ransomware used to mean encrypted files and a ransom note. Now 70% of ransomware claims involve stolen data too, according to Coalition, and those cost more than twice as much. The threat isn't just "pay to unlock." It's "pay or we publish."

Los Angeles saw that model up close this year. In March 2026 the WorldLeaks group listed the City of Los Angeles on its leak site and claimed 159.9 GB of stolen data across 779 files, Security Affairs reported. WorldLeaks focuses on stealing data rather than encrypting it, and goes straight to the threat of disclosure. Backups don't help much against that. The data's already gone.

A city has a security team. Your 40-person firm in El Segundo probably doesn't, and the FBI's numbers show who gets hit outside of hospitals, utilities, and factories. Of the more than 1,400 ransomware complaints from businesses outside critical infrastructure, these industries reported most often:

Law firms on Wilshire. General contractors in the Valley. Architecture studios in Culver City. Those businesses hold files their clients would hate to see published, usually run IT through one overworked person or a part-time provider, and feel enormous pressure to pay when the alternative is calling every client to explain a leak.

How do attackers get in? Sophos' State of Ransomware 2025, a survey of 3,400 organizations hit by ransomware, found exploited software vulnerabilities behind 32% of attacks, stolen credentials behind 23%, malicious email behind 19%, and phishing behind 18%. Unpatched systems and passwords again. Same front door as the last section.

Coalition also found initial ransom demands jumped 47% in 2025, while a record 86% of businesses refused to pay. Refusing is only an option when you can recover without the attacker. Our look at the real cost of a ransomware attack in 2026 prices out what recovery runs, and ransomware protection and recovery services covers what has to be in place before the bad day.

AI voice clones make the old scams harder to spot

The FBI warned in May 2025 that criminals were using AI-generated voice messages to impersonate senior officials and their contacts. California victims reported $159.0 million in 2025 losses tied to AI-related crimes.

According to the FBI's public service announcement, the texts and cloned voice messages were built to establish rapport first, then move the target to another app and ask for access or money. Officials were the targets in that campaign. The playbook carries over to business without changes. A 20-second clip of a CEO on a podcast, a conference panel, or an Instagram reel is enough raw material.

Picture your AP clerk getting a voicemail in your voice asking for an urgent wire before the weekend. Would she question it?

Give her a reason to. A shared code word for payment requests, and a rule that any money request gets confirmed by calling back on a known number, catch what detection software misses. The FBI's own advice is basically that.

Scams that follow LA's disasters

During the January 2025 fires, California's state cybersecurity center, Cal-CSIC, warned that criminals were using Southern California fire themes in phishing emails, scam texts, malicious QR codes, and fake fundraising campaigns, with callers posing as FEMA, charities, and insurers.

LA gets a fresh round of this after every major fire and would get one after a big earthquake. For a business, it shows up as an "insurance adjuster" asking for policy documents, a "relief grant" portal that wants a login, or a contractor invoice for repair work nobody ordered, all landing in the week when everyone's distracted and normal approvals feel slow. It's an awkward week to tighten approvals, which is exactly why attackers pick it.

One paragraph emailed to staff the day a disaster hits, saying to expect these, costs nothing. It lands better when people already get security awareness training the rest of the year. Our post on the hidden IT risks facing LA businesses covers the continuity side of fires, outages, and quakes.

The vendor app you connected in 2022

Between August 8 and 18, 2025, a group Google tracks as UNC6395 used stolen login tokens from Salesloft Drift, a chat and sales app plugged into Salesforce, to pull data out of a large number of corporate Salesforce accounts. It then searched that data for passwords and cloud access keys.

Nobody broke into Salesforce. Google's threat intelligence team was clear on that. The attackers used the access customers had already granted a third-party app, the kind of "Allow" button someone clicked once and never thought about again. A smaller set of Google Workspace mailboxes connected to the same app were read too.

Every LA business has a version of this, whether it's the scheduling tool the front desk signed up for, the e-signature plugin sales installed during a big push, or the AI note-taker somebody added to Teams last spring without asking anyone. Each one holds a key. A quarterly look at which apps can reach your Microsoft 365 or Google data, and pulling the ones nobody uses, is an afternoon of work. Our guide to building a third-party risk management program goes further.

California's 30-day breach clock

Organizations filed 453 data breach notices with California's Attorney General through October 16, 2026, each covering more than 500 California residents. That's slightly ahead of the 444 filed by the same date in 2025.

That count comes from the Attorney General's public breach list, which we pulled and tallied ourselves. Since January 1, 2026, SB 446 has given businesses 30 calendar days to notify affected Californians once a breach is discovered.

30 days isn't long when you don't yet know what was taken. Logs matter here. Without good logs, a business usually can't say which records actually left the building, so it ends up notifying every customer in the database, paying for credit monitoring for all of them, and fielding calls from people whose data was never touched.

Meeting state and industry rules is its own project. Consilien handles compliance work separately from managed IT and security, scoped and priced on its own.

Where should an LA business start?

Start where the money leaves, then where the business stops. For most LA businesses that means locking down payments and email first, then logins, then the ability to recover from ransomware without negotiating.

Endpoint detection and response, in plain terms, is software on every laptop and server that watches for attacker behavior and can cut a machine off the network on its own. Your cyber insurer almost certainly asks about it. Our cyber insurance requirements checklist lists the rest of what carriers want to see.

Half of that table is free. The other half is where it helps to have someone watching alerts at 2 a.m., which is what managed cybersecurity services are for. If you already have an in-house security team running 24/7 monitoring, you don't need an outside one. You might still want a second set of eyes on the call-back rule.

Comparing providers? Our ranking of the top cybersecurity service providers in Los Angeles lays out the options, and what a Los Angeles cybersecurity assessment includes explains where to begin. Consilien runs managed IT and cybersecurity for businesses nationwide, with on-site support across Los Angeles. To see which of these threats your business is most exposed to, speak to a cybersecurity expert.