Suisun City, California: A California city has declared a local state of emergency after a cyberattack disrupted its information technology network and affected critical systems used for 911 call routing, police and fire dispatch, municipal records and other city services.
Suisun City, a community of roughly 30,000 people located between San Francisco and Sacramento, reported that malicious software breached its IT systems on Friday morning. Officials shut down the city’s entire network to contain the attack and protect the affected systems.
Despite the disruption, authorities said emergency response operations remain active. Calls to 911 are being transferred to the neighbouring Solano County dispatch centre, while local police officers and firefighters continue responding to emergencies.
The incident has highlighted the growing risks faced by local governments as essential public services become increasingly dependent on interconnected digital infrastructure.
Cyberattack forces city to shut down IT network
The cyberattack was detected after malicious software compromised Suisun City’s information technology systems.
Authorities responded by taking the entire municipal network offline. The decision was intended to contain the threat and preserve evidence while cybersecurity specialists investigate the incident.
The shutdown has affected a range of internal systems.
Among the disrupted functions are city records, municipal services and digital tools used to support police and fire dispatching. Online services that residents normally use for routine transactions are also temporarily unavailable.
Officials have not yet announced when the complete network will be restored.
The city is instead working with cybersecurity experts to determine the extent of the compromise and establish a safe process for bringing systems back online.
911 emergency response remains operational
One of the most important concerns following the cyberattack was whether residents would still be able to reach emergency services.
City officials have stressed that public safety operations remain functional.
Emergency calls are being automatically transferred to the Solano County dispatch centre, allowing 911 call handling to continue while Suisun City’s own systems remain offline. Local police and firefighters are also continuing to respond directly to calls for service.
The alternative arrangement is particularly important because disruption to emergency communications could have serious consequences.
A failure affecting 911 systems can delay police, fire or medical responses. By rerouting calls to a neighbouring dispatch centre, authorities have been able to maintain an emergency-response pathway despite the municipal network shutdown.
Officials have said there is currently no imminent threat to public safety.
City Council declares state of emergency
The Suisun City Council voted unanimously during a special meeting on Saturday to declare a local State of Emergency.
The declaration is a procedural step that gives the city access to additional resources during the cyber incident.
It can help local authorities obtain emergency funding, technical expertise and specialised assistance while also supporting efforts to recover costs associated with the attack.
For a relatively small municipality, the financial and technical consequences of a major cyberattack can be substantial.
Local governments may not have the same cybersecurity budgets or specialist teams available to larger state and federal agencies. An emergency declaration can therefore help a city mobilise outside support more quickly.
Federal and state agencies involved
The investigation and recovery effort involves more than the city government.
Suisun City is working with federal and state agencies, including the FBI, the Department of Homeland Security and the California Office of Emergency Services, according to local reporting.
The involvement of these agencies reflects the seriousness of an attack affecting public safety infrastructure.
Cybersecurity specialists are examining the compromised systems and determining how the network can be restored without exposing the city to another attack.
Authorities are also working to preserve evidence that could help identify how the breach occurred and who may have been responsible.
Online city services remain unavailable
While emergency operations continue, several routine services have been disrupted.
Residents are temporarily unable to access some online municipal services, including permit processing and online water bill payments. Internal city operations have also been affected while the IT network remains offline.
For residents, the impact is therefore not limited to cybersecurity systems.
The shutdown can affect ordinary interactions with local government, from submitting applications to handling payments and accessing municipal records.
The city has not yet provided a definitive timeline for the restoration of all services.
Officials are prioritising a secure recovery rather than bringing systems back online before they are considered safe.
Authorities have not identified the attackers
At this stage, authorities have not publicly identified the party responsible for the cyberattack.
They have also not confirmed whether the attackers demanded a financial ransom.
That distinction is important because cyberattacks against government networks can involve different motives.
Some attacks are financially motivated and involve ransomware, where criminals encrypt or steal data before demanding payment. Others can be aimed at espionage, disruption, political objectives or simply exploiting vulnerable systems.
Until investigators complete their assessment, it remains unclear which category the Suisun City incident falls into.
Officials have therefore avoided speculating about the identity or motive of the attackers.
Why municipal networks are vulnerable
Local governments have increasingly become targets for cybercriminals because they operate large amounts of sensitive information while often working with limited cybersecurity resources.
Municipal networks can contain public records, employee information, financial systems, law-enforcement data and infrastructure-management tools.
They also support services that residents depend on every day.
An attack does not necessarily need to compromise every system to cause significant disruption. Even taking a central network offline as a precaution can interrupt multiple departments simultaneously.
The Suisun City incident illustrates this vulnerability.
A single cyberattack affected not only administrative systems but also technology connected to emergency dispatch and other public services.
The importance of protecting emergency systems
Cybersecurity risks become particularly serious when attacks reach systems connected to emergency response.
A city can potentially suspend a permit application or delay an online payment without creating an immediate threat to life.
Emergency communications are different.
911 call routing and dispatch systems need to remain available around the clock because residents may depend on them during fires, accidents, medical emergencies or crimes.
Suisun City’s decision to route calls through Solano County demonstrates the importance of having contingency arrangements in place.
The alternative dispatch system has allowed emergency response to continue even while the city’s own IT network remains shut down.
Cybersecurity experts warn about prevention
The incident has also renewed discussion about the cost of preventing cyberattacks.
Cybersecurity expert Alex Hammerstone told NewsNation that organisations can find it easier to obtain funding to repair systems after an incident than to secure them beforehand.
That challenge is particularly relevant to smaller local governments.
Preventive cybersecurity spending can compete with other public priorities, while the benefits of such spending may not be immediately visible.
However, a major cyberattack can result in much larger costs.
Beyond technical recovery, governments may face expenses related to emergency response, investigations, legal requirements, system replacement and restoring public services.
The financial impact can therefore extend well beyond the cost of cybersecurity software.
Why shutting down the network can be necessary
Taking an entire IT network offline may appear extreme, but it can be an important containment measure following a serious breach.
If malicious software is spreading through connected systems, keeping compromised networks online can allow attackers to maintain access or move between systems.
Disconnecting the network can help limit further damage while investigators assess what has happened.
It can also help preserve evidence for a forensic investigation.
However, the downside is that legitimate city services may also become unavailable.
Suisun City’s experience demonstrates this trade-off: shutting down the network has disrupted online and internal services, but it has also provided authorities with an opportunity to contain the incident and investigate safely.
Recovery could take time
Restoring a municipal network after a cyberattack is not necessarily as simple as switching systems back on.
Cybersecurity teams need to determine which systems were compromised, remove malicious software, secure vulnerabilities and verify that attackers no longer have access.
They may also need to rebuild certain systems from clean backups.
Before reconnecting critical services, authorities must have confidence that the network is secure.
This is especially important for systems connected to public safety.
A premature restoration could expose the city to another compromise.
For that reason, officials have not given a specific timetable for returning all services to normal.
What the incident means for residents
For residents of Suisun City, the immediate priority is maintaining access to emergency services.
Authorities have said 911 operations remain active through the Solano County dispatch centre, while police and fire personnel continue responding to calls.
The main inconvenience for residents currently involves non-emergency services.
Online permit processing, water bill payments and other municipal functions may remain unavailable until systems are restored.
Residents may therefore need to rely on alternative communication channels or wait until affected services return.
The city is expected to provide updates as its recovery progresses.
A warning for other cities
The Suisun City attack also offers a warning to other municipalities.
Cities of all sizes increasingly rely on digital infrastructure for everything from emergency communications to billing and public records.
As dependence on technology grows, cybersecurity becomes part of basic public infrastructure protection.
Emergency systems need particular attention because a disruption can have consequences far beyond financial losses.
Cities may need to maintain backup communication systems, alternative dispatch arrangements, offline procedures and regularly tested recovery plans.
The ability to continue 911 operations in Suisun City despite the network shutdown shows how important such contingency measures can be.
Cyberattacks can affect public confidence
A cyberattack can also create uncertainty among residents.
People may wonder whether their personal information was stolen, whether government records remain intact or whether essential services are safe.
Authorities have not publicly confirmed the extent of any potential data compromise in the Suisun City incident.
The investigation will need to determine whether attackers accessed or extracted information in addition to disrupting systems.
Clear communication will therefore be important as the city moves through the recovery process.
Residents will want to know not only when services will return but also whether their personal information has been affected.
The wider cybersecurity challenge
The incident comes amid a broader increase in concern over cyberattacks against government institutions and critical infrastructure.
Local governments can be attractive targets because their networks may connect multiple services and departments.
At the same time, municipalities often have limited resources compared with large corporations or federal agencies.
This combination can create vulnerabilities.
The growing sophistication of cyberattacks means that cybersecurity can no longer be treated solely as an IT department responsibility.
Emergency services, finance departments, public works, utilities and administrative offices all need plans for operating during a prolonged technology outage.
What happens next?
The immediate focus in Suisun City is containment, investigation and recovery.
Cybersecurity specialists are examining the compromised systems, while government agencies are assisting with the response.
Authorities will also need to establish how the attackers gained access and whether any vulnerabilities remain.
Only after those questions are addressed can the city safely begin restoring its systems.
The city will also have to assess the financial and operational impact of the incident.
The emergency declaration should help authorities access additional resources and recover some of the costs associated with the response.
Conclusion
Suisun City in California has declared a local state of emergency after a cyberattack compromised its IT network and disrupted systems supporting 911 call routing, police and fire dispatch, municipal records and online services.
The city responded by shutting down its network, while emergency calls were redirected to the Solano County dispatch centre. Police and firefighters have continued responding to emergencies, allowing public safety operations to remain active despite the wider technology disruption.
Authorities have not identified the attackers or confirmed whether a ransom was demanded. The FBI, Department of Homeland Security, California Office of Emergency Services and cybersecurity specialists are involved in the investigation and recovery effort.
The incident highlights a critical lesson for municipalities: protecting digital infrastructure is now closely connected to protecting public safety. As governments become increasingly dependent on technology, strong cybersecurity, backup systems and emergency recovery plans are essential to ensuring that a cyberattack does not turn into a wider public-services crisis.