A cyberattack 911 system failure is the kind of event most people assume cannot happen, right up until it does. In Suisun City, California, it happened on Friday, and the city remains under a state of emergency while investigators work to untangle it.

At a special council meeting on Saturday, officials confirmed that malicious software had compromised the city’s computer systems. The response was drastic but necessary: the entire municipal network was taken offline, including 911 call routing and dispatch for both police and fire.

How Calls Kept Getting Answered

The immediate concern in any incident like this is whether emergency calls simply stopped connecting.

They did not. Dispatchers relocated to the county’s backup dispatch center and continued taking 911 calls from there. In its public statement, the city said there is no imminent threat to residents.

That backup arrangement is the entire reason this became a serious inconvenience rather than a catastrophe. Which is worth sitting with, because not every municipality has one that works.

Small City, Large Warning

Suisun City has close to 30,000 residents, a fraction of the population of nearby San Francisco. It is not the kind of place that would appear on a list of high-value targets.

That is arguably the point.

Cybersecurity expert Alex Hammerstone, speaking with NewsNation’s Courtney Friel on Sunday, said the incident exposes real weaknesses in the 911 system and demonstrates why cities need to move on cybersecurity before something breaks rather than after.

He described a budgeting dynamic anyone who has worked in local government will recognize immediately. Once an incident occurs, funding to fix it appears without much resistance. Securing money beforehand, for prevention that produces no visible result, is considerably harder.

That asymmetry explains a great deal about why municipal systems keep failing. Prevention has no photo opportunity. Recovery does.

Why Small Municipalities Are Attractive Targets

There is a practical logic to attacks on smaller cities that is worth understanding.

Local governments run essential services on aging infrastructure with limited IT staff. Many have one or two people responsible for everything from email accounts to dispatch software. Systems get layered over decades, with newer tools bolted onto older platforms that were never designed to face the internet.

At the same time, the pressure to restore service is enormous. A city cannot leave emergency dispatch down while it deliberates. That urgency is exactly what attackers count on.

The result is a category of target that combines low defenses with high stakes.

A Broader Pattern of Infrastructure Attacks

The Suisun City breach arrives while federal investigators are already dealing with something larger.

Water systems across at least twelve states have been targeted in a wave of cyberattacks. In some instances, utilities lost the ability to remotely monitor and control their systems, forcing staff to revert to manual operation.

More seriously, officials say intruders gained remote access to physical equipment, including pumps, valves and water-pressure controls. That is the line between data theft and the capacity to affect what comes out of a tap.

Federal investigators suspect Iran-backed hackers may be behind those intrusions, though the U.S. government has not formally attributed them.

Whether Suisun City connects to that campaign is unknown. No attribution has been made.

Who Is Investigating

The FBI, the Department of Homeland Security and California’s emergency services office are all involved in examining the breach and helping restore the city’s systems.

Recovery in cases like this is rarely quick. Investigators must determine how attackers got in, what they accessed, whether they still have a foothold, and whether backups themselves were compromised. Rebuilding before those questions are answered risks restoring the vulnerability along with the service.

What Residents Should Know

If you live in an area experiencing something similar, a few things matter.

Emergency calls should still connect through backup routing, but check whether your city has published an alternate direct number for police and fire. Save it in your phone rather than trusting you will find it during an emergency.

Expect delays in non-emergency municipal services, including permits, payments and records requests, since those systems typically come back last.

Be alert to fraud attempts. Publicized outages attract scammers who call residents claiming to represent the city and requesting payment information or account details. Municipalities do not resolve cyber incidents by asking residents for personal data over the phone.

The Uncomfortable Takeaway

A city of 30,000 lost its emergency dispatch network to a software intrusion and had to declare a local emergency. Calls kept getting answered because a county fallback existed.

The question every other municipality should be asking this week is whether theirs would have.

Hammerstone’s point about budgets is the whole story in miniature. The money arrives after. What is expensive and unglamorous is spending it before, on systems nobody notices working.

A note on sourcing: the investigation is ongoing and key facts, including who was responsible and how the intrusion occurred, remain undetermined.