Suisun City Declares Emergency After Malware Cripples 911 Systems and City Network

The Suisun City cyberattack that began Friday morning has forced local officials to take an unusual step: shutting down their own computer network entirely and declaring a formal state of emergency.

The City Council approved the declaration during a special meeting Saturday morning, roughly a day after malicious software began working its way through the city’s information technology systems.

How It Started

According to a statement posted by the city on social media, malicious software infected and compromised its IT systems beginning around 5:45 a.m. on Friday.

The impact reached well beyond routine administrative functions. The city said the incident struck critical public safety operations, including 911 call routing, police and fire dispatch, records systems, and general city services.

For a community of roughly 30,000 people in the East Bay, that is close to a total operational disruption.

The Decision to Pull the Plug

Faced with an active infection, city officials made the call to take the entire network offline.

The city said the shutdown served two purposes: containing the threat before it could spread further, and preserving evidence for a federal investigation.

That combination is standard practice in serious municipal cyber incidents. Leaving systems running risks allowing malware to move laterally into backups and connected networks. It can also allow attackers to erase logs that investigators later need.

The tradeoff is severe. Taking everything down means losing access to the tools staff rely on for daily work, which is precisely what has happened.

Emergency Services Kept Running

Despite the scale of the disruption, officials have been clear that emergency response never stopped.

Suisun City dispatchers began routing calls for service through the Solano County dispatch center, a fallback arrangement that kept the 911 pipeline functioning while local systems were down.

Police officers and firefighters continued responding to calls throughout the incident.

The city stated there is no imminent threat to the public and that all public safety services remain active.

What is unavailable are online city services and internal operations, meaning residents cannot access web-based municipal functions and staff are working without their normal systems.

What the Emergency Declaration Does

The state of emergency approved Saturday is not primarily a warning to residents. It is an administrative tool.

The declaration allows the city to access emergency support services and to recoup costs associated with the cybersecurity incident.

That financial dimension matters more than it might appear. Recovery from a serious attack on a municipal network routinely runs into six or seven figures once forensic investigation, system rebuilding, hardware replacement, legal review, and overtime are accounted for. For a city of 30,000, those costs can devastate a budget without outside assistance.

Federal and State Agencies Involved

Suisun City is not handling the response alone.

The city said it is working with the FBI, the Department of Homeland Security, and the California Office of Emergency Services to investigate the incident and restore systems.

Federal involvement is typical when critical infrastructure or public safety systems are affected. The FBI brings investigative capability and visibility into whether the same attackers have hit other targets. DHS, through its cybersecurity arm, provides technical assistance with containment and recovery.

State emergency services coordinate resources and can help connect the city to support it could not obtain on its own.

Why Small Cities Are Frequent Targets

Attacks on municipal governments have become common across the United States, and the reasons are structural rather than accidental.

Small and mid-sized cities operate essential systems on limited budgets. IT departments are often thin, sometimes a handful of people covering everything from user support to network security. Software may run past its support window because replacement is expensive. Dedicated security staff are frequently a luxury rather than a standard position.

At the same time, the pressure to restore service is enormous. A city that cannot dispatch emergency responders or process payments faces immediate public consequences, which attackers understand well.

That combination makes local government an attractive target.

What Residents Should Watch For

Officials have not indicated whether personal data was accessed, and in most incidents that determination takes weeks of forensic work.

In the meantime, some general precautions are sensible for residents of any community experiencing this kind of event.

Be skeptical of unexpected emails, texts, or calls claiming to come from the city, particularly any requesting payment or personal information. Attackers and opportunists often exploit the confusion following a publicized breach.

Verify communications through official channels rather than links provided in messages.

Monitor financial accounts and consider a credit freeze if the city later confirms that personal data was exposed.

Continue to call 911 normally in an emergency. The routing has changed on the back end, but the number works.

The Road Back

Recovery from an incident like this is measured in weeks, not days.

Systems must be rebuilt rather than simply restarted, because reconnecting a compromised machine can reintroduce the infection. Backups have to be verified as clean before restoration. Each service typically comes back in stages, prioritized by criticality.

For now, Suisun City is operating in a degraded but functional state. Emergency calls are being answered, officers and firefighters are responding, and the network stays dark while investigators work.

No timeline for full restoration has been announced.