Vallejo City Confirms Email Breach After Fraudulent Tiffany & Co. Phishing Scam The City of Vallejo disclosed on June 5, 2026, that unauthorized actors compromised its email management platform, Constant Contact, to send a fraudulent phishing email. The malicious message, titled “something awaits,” was distributed at approximately 4 p.m. on June 4 from the city’s official [email protected] address. Disguised as a communication from luxury jeweler Tiffany & Co., the email contained a link designed to deceive recipients into clicking. Vallejo’s Information Technology Department is investigating the breach to determine the intrusion’s origin and scope. As of the latest update, officials stated there is no evidence of public risk or compromise of personal data stored on Constant Contact. The city is implementing measures to secure the platform. Recipients were advised to delete the email, with no further action required. This incident follows a notable 2016 data breach in which Vallejo accidentally exposed employee Social Security numbers in response to a public records request from Transparent California. The city did not notify affected employees until five months later, later providing identity protection services at no cost.