Suisun City, a Northern California municipality of roughly 30,000 people about 55 miles north of San Francisco, is entering its second week of response to a cyber-incident that forced officials to take the city's entire IT network offline. Malicious software was detected on the network at roughly 5:45 a.m. on Friday, August 7 (Infosecurity Magazine; the Daily Republic reports the incident "came to light just before 6 a.m. Friday"). The City Council declared a local state of emergency in a special Saturday session, City Hall has been closed for at least a week, and 911 calls are being handled by Suisun City dispatchers working out of the Solano County dispatch center. The FBI, the Department of Homeland Security and the California Office of Emergency Services are all involved. No threat actor has been publicly identified, no ransom demand has been confirmed, and city officials say they are not currently aware of any personal information being compromised. Note on naming: Infosecurity Magazine renders the city as "Suisan City" throughout; local outlets and the city itself use "Suisun City."
What Happened
The city's own account, relayed consistently across the Daily Republic, NBC Bay Area, CBS San Francisco and Straight Arrow News, is that an infection of "malicious software" was discovered on the municipal network early Friday morning. Rather than attempt surgical containment, Suisun City shut down its complete IT environment for two stated reasons: to cut the attacker off, and to preserve evidence for a federal investigation. The Emergency Operations Center was activated and is running alongside federal, state and regional partners.
The Council's emergency declaration on Saturday, August 8 unlocked access to state and federal emergency resources and, as the Daily Republic put it, "softens the financial blow" of the response. Infosecurity Magazine reports that Council Member Princess Washington disclosed on LinkedIn late on August 10 that a further emergency meeting was scheduled for August 11, with the Council expected to consider convening a closed session to receive information and give direction on the incident.
Accounts differ meaningfully on how far the disruption reached into public safety. The Daily Republic reports the attack "took out the city's emergency dispatch line," and Infosecurity Magazine lists 911 call routing plus police and fire dispatch among affected systems. Straight Arrow News similarly says the attack affected fire and police communications including 911 routing. NBC Bay Area, quoting city public information officer Michael Elm, frames it differently: emergency response capabilities "remain fully functional," with the heaviest impact falling on finance, human resources and the housing authority. The reconciliation that fits all accounts is that the city's own dispatch infrastructure was degraded or taken offline as part of the shutdown, and continuity was preserved by relocating Suisun City dispatchers to Solano County's center. All sources agree that residents calling 911 still reach a Suisun City dispatcher and that police and fire units are still responding.
Beyond public safety, the outage has closed City Hall, suspended online services and internal operations, and halted in-person meetings across departments including planning, housing and water. Officials have repeatedly stated there is "no imminent threat to the public." On recovery, Elm told NBC Bay Area that City Hall could potentially reopen within the week but full system restoration is projected at "Halloween time," meaning weeks to months of rebuild work. Straight Arrow News reports officials believe this is the city's first cyberattack of this kind.
What Was Taken
Nothing has been confirmed stolen. This is the single most important caveat in the Suisun City story so far, and it should be read as provisional rather than reassuring. Officials told NBC Bay Area they are "not currently aware of any personal information being compromised," which is a statement about the current state of an incomplete forensic investigation, not a finding of no exfiltration. There is no leak-site posting, no ransom note detail, and no data-set description in the public record. Infosecurity Magazine reports only that there are "indications that the incident is ransomware-related," with no official confirmation of the source of the attack or the perpetrators.
For scale context on what a data-theft outcome actually looks like when it is eventually quantified, two unrelated incidents in the same source set are instructive. BleepingComputer reports that healthcare revenue-cycle software firm Unlimited Technology Systems has now attributed 3,803,750 affected individuals to an October 2025 intrusion, per an entry on the U.S. Department of Health and Human Services breach portal; the company's own July 20, 2026 disclosure describes an unauthorized actor accessing files between October 5 and October 10, 2025, detected on October 19, 2025, with exposed data spanning names, Social Security numbers, dates of birth, contact details, government ID scans, insurance cards, intake forms and claims and benefits information. Notably, the firm filed notification samples with authorities on July 1, 2026 without disclosing a count at all. Separately, Tech Insider reports that Ernst & Young disclosed in mid-July 2026 that an unauthorized third party spent roughly two weeks inside a vendor-managed IT support platform serving its tax practice, exposing client financial and tax records, with an 81-day gap before disclosure. Neither incident is connected to Suisun City, and the EY account rests on a single lower-tier source, so treat its specifics accordingly. What both illustrate is the lag: the true victim count in an incident like Suisun City's, if there is one, will surface months from now, not this week.
Why It Matters
Suisun City is not an outlier. NBC Bay Area situates it in a run of Bay Area municipal compromises: Foster City was hit in March 2026, and Oakley and Pleasant Hill were targeted earlier. Infosecurity Magazine frames the incident against a broader spate of attacks on US local authorities.
The strategic point is the target profile. A city of 30,000 has the attack surface and the public-safety dependencies of a much larger organization, and typically a fraction of the security staff and budget. It runs 911 routing, dispatch, records, utility billing, water infrastructure, housing authority systems and finance on a network that in practice is often flat enough that a single malware foothold justifies a full-environment shutdown. That is exactly what happened here, and the shutdown decision, while defensible, is itself the outage. The city traded weeks of service degradation for containment and evidence preservation, which is the correct call and also a measure of how little confidence a defender can have in segmentation once an unknown actor is inside.
The projected restoration timeline of roughly twelve weeks is the number defenders should carry away. Small-municipality recovery is not measured in days because rebuilding means re-standing servers, re-imaging endpoints, restoring from backups of uncertain integrity and revalidating every system before it touches the network again.
Straight Arrow News places the incident alongside a separate and unresolved federal investigation into attacks on municipal water systems. Per that reporting, suspected Iran-linked activity affected more than 30 water systems in Minnesota before expanding to at least 12 states; in late July the FBI, EPA and CISA said attackers had gained remote access to water and wastewater infrastructure in at least seven states, and CISA warned that Iran-affiliated actors were targeting internet-connected equipment controlling pumps and valves "to cause disruptive effects within the United States," with US intelligence agencies attributing the water-system activity to Iran's Islamic Revolutionary Guard Corps. There is no evidence linking that campaign to Suisun City, and officials have explicitly not identified who carried out this attack or whether public safety communications were specifically targeted. The relevance is environmental: local government and small utility networks are simultaneously under criminal ransomware pressure and state-aligned probing, and a small city IT team cannot easily tell which one it is looking at on day one.
The Attack Technique
Initial access is unknown. No source identifies an exploited vulnerability, a phishing vector, a compromised VPN or RDP credential, or a third-party service as the entry point. No malware family has been named, and no ransomware brand has claimed the city.
What the public record supports is limited: malicious software was present on the city network and detected in the early morning of August 7; the infection was significant enough that the city judged full network shutdown to be the only reliable containment; and, per Infosecurity Magazine, there are unconfirmed indications the incident is ransomware-related. The early-morning detection window and the breadth of affected services, spanning finance, HR, housing and dispatch-adjacent systems, are consistent with a domain-wide deployment rather than an isolated endpoint infection, but that is inference, not reporting. Straight Arrow News is explicit that officials have not said who did it, whether public safety was deliberately targeted, or when the network will be back.
Anyone attributing this to a named crew right now is ahead of the evidence.
What Organizations Should Do
- Assume your containment plan is a full-shutdown plan, and cost it. Suisun City had to take everything down. Model what a total network isolation actually does to your revenue, service delivery and statutory obligations, and pre-authorize the decision so it does not need to be litigated at 6 a.m.
- Build and rehearse out-of-band public safety and business continuity paths. The reason Suisun City residents still reach a dispatcher is that a mutual-aid arrangement with Solano County existed and could be activated. Identify your equivalent, document it, and test the cutover before you need it.
- Segment public-safety and operational technology away from general enterprise IT. Finance, HR and housing systems being on a path that leads to dispatch infrastructure is what turns a business-systems infection into an emergency declaration. Segmentation is what buys you a partial shutdown instead of a total one.
- Validate offline, immutable backups and time your restore, not just your backup. A twelve-week restoration estimate is what happens when recovery has to be reconstructed rather than executed. Run a full-environment restore drill and measure the wall-clock result.
- Pre-establish the federal and state relationships now. Suisun City had the FBI, DHS and Cal OES engaged within roughly 24 hours and used an emergency declaration to unlock resources and funding. Know your local FBI field office and CISA regional contact, and know what your jurisdiction's emergency declaration process requires, before an incident.
- Prepare disclosure discipline in advance. "We are not currently aware of any personal information being compromised" is an accurate and appropriate day-five statement. Note how often, as in the Unlimited Technology Systems case, the real figure arrives many months later via a regulator portal. Plan for a staged disclosure that will not have to be retracted.
- Hunt for pre-positioning in adjacent infrastructure. Given the concurrent federal advisories on remote access to water and wastewater control equipment, small municipalities and utilities should audit internet-exposed HMIs, PLCs and remote-access appliances, enforce MFA on every remote entry point, and remove default and shared credentials.
Sources: Suisan City, California, Responds to Cyber Incident Amid Wave of US... | Unlimited Technology Systems breach impacts 3.8 million people | Cyberattack shutters Suisun City Hall, prompts local state of emerg... | Suisun City’s entire IT system shut down after cyberattack, officia... | Public safety, City Hall affected by cybersecurity incident Police... | From 911 calls to water pumps, cyberattacks move closer to home | Suisun City Council declares state of emergency after cyberattack –... | EY Data Breach 2026: Tax Data Exposed, 81-Day Delay