Cyberattack Forces California City to Shut Down Network

Suisun City, California became the latest municipality to fall victim to a cyberattack targeting critical public infrastructure, declaring a local state of emergency after malicious software compromised its entire IT network — disrupting 911 call routing, police and fire dispatch, city records, and other online services.

What Happened:

The incident began at around 5:45 a.m. on Friday, August 7, according to the city's incident page. City leaders announced Saturday that malicious software had compromised the city's computer systems the day before, and the attack forced officials to take the entire network offline, disrupting 911 call routing as well as police and fire dispatch operations. To contain the threat and preserve evidence for a federal investigation, the city shut down its entire IT network.

The city council held a special meeting Saturday morning and unanimously voted to declare a local state of emergency under California Government Code 8630, a designation that allows the city to access emergency assistance more quickly and seek reimbursement for costs connected to the cyberattack.

The Response:

Dispatchers have since moved their operations to the county's backup dispatch center to continue answering 911 calls, and officials say emergency calls and responses have continued without interruption despite the network shutdown. The city swiftly activated its Emergency Operations Center and is working alongside federal, state and regional agencies — including the FBI, Department of Homeland Security, and California Office of Emergency Services — to maintain emergency services, investigate the incident, and restore systems.

Officials have been careful to reassure residents about immediate safety while being transparent about ongoing disruption. A city official said that from a public safety standpoint, there's no threat to the public at this time, though for residents, the main effect currently is an inability to use certain online services, including paying water bills and processing permits. There's no estimated restoration timeline, since every network function must be inspected and cleared before it can return.

Notably, despite initial appearances, officials have not identified the malicious software as ransomware, and have not yet named a suspected attacker or said whether any information was stolen. This is believed to be the first attack of its kind against Suisun City.

Why This Matters Beyond One City:

This incident is a near-textbook illustration of the pattern we've discussed repeatedly — nation-state and criminal actors increasingly targeting operational technology and public safety infrastructure, not just data. Two things stand out:

Small municipalities are the soft underbelly of critical infrastructure. A city of 30,000 people rarely has the cybersecurity budget, dedicated SOC staffing, or incident-response maturity of a major metro area or federal agency — yet it runs the same category of life-critical systems (911 dispatch, emergency records) as much larger jurisdictions. This mirrors the water-utility attacks we discussed earlier: attackers are gravitating toward under-resourced, high-consequence targets precisely because the defense-to-impact ratio favors them.

"Shut it all down" is still the primary containment tool in 2026. The fact that the city's only real option was to take its entire network offline — rather than surgically isolate the compromised segment — points to a lack of network segmentation between administrative IT and public-safety-critical systems. This is exactly the kind of gap that frameworks like Zero Trust architecture and IT/OT segmentation (which we discussed regarding the water-system attacks) are meant to close. Had dispatch systems been properly segmented from general municipal IT, a compromise in one might not have forced a wholesale shutdown of the other.

The backup fallback worked — because it existed. The fact that Solano County's backup dispatch center could absorb 911 call routing without a gap in service is the single most important resilience factor in this story. It's a concrete demonstration of the "maintain the ability to operate manually/via backup during a cyber incident" principle that federal advisories have been urging utilities and municipalities to adopt.