Suisun City Cyberattack: What Happened

At 5:45 a.m. on Friday, August 7, 2026, the City of Suisun City, California, detected a cyberattack involving 'malicious software' that infected its information technology systems. The attack disrupted critical public safety operations, including 911 call routing, police and fire dispatch, records, and other city services. In response, the city shut down its entire IT network to contain the threat and preserve evidence for a federal investigation.

The Suisun City Council declared a state of emergency on Saturday, August 8, 2026. Dispatchers rerouted emergency calls through the Solano County dispatch center, and the city activated its emergency operations center. Officials stated there was no imminent threat to the public and that all public safety services remained active. Online city services and internal operations were temporarily unavailable as of Sunday morning.

The attack is believed to be the first of its kind in the city of approximately 30,000 residents, located 55 miles north of San Francisco. The incident occurs amid broader federal investigations into cyberattacks targeting municipal water systems in multiple states, with warnings about Iran-affiliated hackers targeting internet-connected infrastructure. The city's IT system is designed to automatically shut down upon detecting an intruder, according to Michael Elm of the Suisun City Public Information Office.

Suisun City Cyberattack Timeline

The city detected the intrusion at 5:45 a.m. on Friday. The malicious software hit critical public safety operations, including 911 routing, police and fire dispatch, records, and city services. To contain the threat and preserve evidence for a federal investigation, the city shut down its entire IT network. The city's IT system is configured to automatically shut down when it detects an intruder, according to Michael Elm of the Suisun City Public Information Office.

By Saturday, the City Council had declared a state of emergency. Dispatchers began taking emergency police and fire calls through the Solano County dispatch center, and the emergency operations center was activated. As of Sunday morning, online city services and internal operations remained temporarily unavailable while cybersecurity experts investigated and worked to restore systems.

Impact on Public Safety and City Services

The attack affected the communication operations of the fire and police departments, including the routing of 911 calls. However, officials emphasized that there was no interruption to emergency services or to dispatchers being able to answer 911 calls; some software became unusable, but the rerouting through the county center kept the lines open. From a public safety standpoint, there was no threat to the public at that time, according to Elm. For residents, the most visible impact was the temporary unavailability of online services, such as paying water bills or processing permits.

Response and Recovery Efforts

The city's response was swift: it shut down the entire IT network to contain the threat and preserve evidence for a federal investigation. The city activated its emergency operations center and rerouted dispatch through Solano County. Cybersecurity experts were brought in to investigate the incident and work on restoring systems. As of Sunday morning, online city services and internal operations remained temporarily unavailable.

This incident is part of a broader pattern of cyberattacks targeting municipal infrastructure. Federal agencies are investigating cyberattacks targeting municipal water systems in a dozen states. Late last month, the FBI, the Environmental Protection Agency, and the Cybersecurity and Infrastructure Security Agency warned that cyberattackers remotely accessed online infrastructure for water and wastewater systems in at least seven states, with warnings about Iran-affiliated hackers targeting internet-connected industrial control systems.

Broader Implications for Municipal Cybersecurity

The Suisun City attack highlights the growing threat of cyberattacks on essential services in local communities. As cities increasingly rely on internet-connected systems for public safety, utilities, and administrative functions, they become attractive targets for malicious actors. The attack on Suisun City is believed to be the first of its kind in the city, but it serves as a warning for municipalities nationwide.

For residents and local governments, the key takeaways are the importance of having robust incident response plans, the value of automatic shutdown mechanisms, and the need for coordination with county and federal agencies. The city's ability to quickly reroute 911 calls and maintain public safety services demonstrates the resilience that can be built into emergency systems.

As the investigation continues, the city is working to restore full services. The federal investigation will likely shed light on the attackers' identity and methods, but the immediate focus is on recovery and ensuring that such an incident does not happen again.