Suisun City has declared a state of emergency after a cyberattack forced officials to shut down the entire municipal computer network, disrupting 911 call routing, police and fire dispatch, records systems and other city services, according to KQED and the Los Angeles Times.
City officials said malicious software infected its information technology systems around 5:45 a.m. Friday. The intrusion "hit critical public safety operations, including 911 routing, police and fire dispatch, records and City services," according to a statement posted on the city's website. Suisun City Police dispatchers immediately began routing emergency calls through the Solano County dispatch center, and officials activated the city's emergency operations center to manage the response.
Despite the scale of the disruption, officials sought to reassure residents that public safety itself was not compromised. "From a public safety standpoint, there's no threat to the public at this time," said Michael Elm of the Suisun City Public Information Office, according to KQED. Elm said the more tangible impact for residents of the city of roughly 30,000, located about 55 miles north of San Francisco, would likely be mundane inconveniences such as being unable to pay a water bill or process a permit while systems remain offline.
Elm said there was no interruption to emergency services or to dispatchers' ability to answer 911 calls, though some software became unusable once the network was shut down. The city said it deliberately took its entire IT network offline to preserve evidence for a federal investigation, and Elm noted that Suisun City's systems are designed to automatically shut down when an intruder is detected.
City Council members held a special meeting Saturday morning to formally declare the state of emergency, which the city said allows it to "quickly access emergency support services and to recoup costs" tied to the incident. Suisun City is now working with the FBI, the Department of Homeland Security and the California Office of Emergency Services to investigate the breach and restore operations, KQED reported.
Elm told KQED that a significant portion of the investigation was set to begin the following day, when private and government cybersecurity experts arrived in the city. Systems will remain shut down function by function, with each cleared individually before being brought back online, and the city said it has no estimate for when full services will resume. As of Sunday morning, online city services and internal operations remained temporarily unavailable while the investigation continued, according to the Los Angeles Times.
The Los Angeles Times reported that the attack is believed to be the first of its kind for Suisun City, occurring as cybersecurity threats to essential local government services grow across the country. The newspaper noted that federal agencies believe some recent cyberattacks targeting infrastructure may be affiliated with Iran, though it did not report any direct evidence linking the Suisun City incident to a specific foreign actor.
Broader Pattern Of Attacks On Municipal Systems
The Los Angeles Times placed the Suisun City incident within a wider wave of cyberattacks on public infrastructure. Federal agencies are investigating cyberattacks targeting municipal water systems across a dozen states, the paper reported. Late last month, the FBI, the Environmental Protection Agency and the Cybersecurity and Infrastructure Security Agency warned that hackers had remotely accessed online infrastructure for water and wastewater systems in at least seven states, with the agencies attributing the activity to Iran-affiliated actors seeking to "cause disruptive effects within the United States."
The Times noted that smaller water systems often rely on internet-connected automated controls but lack resources for adequate security. In one example cited by the paper, 30 water systems in Minnesota were affected by a cyberattack that caused dramatic drops in water levels before backup systems kicked in.
In response to that pattern, a bipartisan group of lawmakers recently urged restoration of federal funding for Department of Homeland Security programs that coordinate cybersecurity efforts across states, according to the Los Angeles Times. Gov. Gavin Newsom's office told the Times there is no evidence California water systems were among those targeted in the recent spate of attacks, but warned that a patchwork, state-by-state approach to cybersecurity is inherently weaker than a coordinated federal response. "Cyber threats do not stop at state lines, and no state can defend against them alone," the governor's office said, adding that federal cuts to cybersecurity staffing and programs have weakened the intelligence-sharing and technical support that help protect essential services nationwide.
Suisun City is not the first Bay Area municipality to be hit this year. KQED reported that Foster City declared its own state of emergency after a ransomware attack in March knocked out many services for more than a week, and that Pittsburg lost nearly $1 million to a February phishing scam, though more than half of those funds were later recovered.
Cybersecurity experts who spoke with KQED said such attacks on local governments have become routine rather than exceptional. Chris Hoofnagle, faculty director at the UC Berkeley Center for Law and Technology, pointed to Oakland's 2023 ransomware attack, which among other disruptions prevented the city from collecting parking payments. "If you can prevent a city from collecting taxes, business taxes, local taxes and so on, it's quite coercive that cities might end up paying a ransom to unlock their systems," Hoofnagle told KQED.
David Wagner, a professor in UC Berkeley's Department of Electrical Engineering and Computer Sciences, said the underlying motive behind most such intrusions is financial. "The goal of cyberattacks is typically to get the city to pay a ransom," Wagner said, adding that "cybersecurity attacks on small cities are common" because "criminals see them as easy prey."
For now, Suisun City residents are being asked to rely on the Solano County dispatch center for emergency calls while investigators work through the affected systems. City officials have not said whether any ransom demand was made or whether data was stolen, and have given no timeline for when normal online services, permitting and billing systems will return.
