Malware disrupts Suisun City services

Analyst assessment

Suisun City experienced a malware attack Aug. 7, 2026, that compromised municipal IT systems and disrupted public-safety and government services. The city’s incident updates said malicious software infected city systems at about 5:45 a.m., prompting officials to shut down the network, activate the Emergency Operations Center and coordinate with federal, state and regional agencies.

DysruptionHub assesses with high confidence that malicious cyber activity caused the disruption. Ransomware involvement is assessed with medium confidence. Bay City News reported that the City Council planned to consider the city’s response to demands from the perpetrators, according to the City Manager’s Office. A councilmember separately characterized city records as being held hostage. That evidence establishes an extortion-related communication and makes ransomware likely, but it does not disclose the demand terms or confirm encryption.

Operational significance

The incident affected 911 routing, police and fire dispatch, records, online services and routine municipal operations. Dispatchers shifted 911 and nonemergency call handling to the Solano County dispatch center while Suisun City police officers and firefighters continued responding. City Hall closures limited in-person access to planning, building, housing, water, finance, human resources, public works and administration.

Recovery remained partial in late August. The city’s Aug. 25 update said the water counter was the only open City Hall service and could accept cash or check, but not credit or debit cards. Planning, building, housing, finance, human resources, public works, the City Manager’s Office and administration remained closed. Dispatchers continued taking calls through Solano County.

The city said Aug. 26 that it had moved the water-disconnection deadline from Aug. 26 to Sept. 2 because of operational adjustments. The notice continued to describe restoration and investigation as ongoing.

Current status

The incident remains active. Suisun City’s Aug. 25-26 updates documented continuing department closures, payment limitations, the county-dispatch workaround and a water-service policy delay tied to operational adjustments. On Sept. 2, the city’s live website continued to display a present-tense cybersecurity banner saying the incident had affected services at City Hall and public-safety departments. Sept. 2 is therefore the latest operational-impact observation.

The Los Angeles Times previously quoted City Manager Bret Prebula saying full restoration could take until Halloween. No authoritative full-restoration or all-clear notice has been located.

Disclosure posture

Suisun City promptly used cybersecurity language and disclosed the malware finding, approximate infection time, network shutdown, affected functions and agency coordination. Public reporting later revealed that officials were considering perpetrator demands, but the city has not publicly described those demands in its incident updates.

Confidence and uncertainty

Confidence is high that malware compromised the city network and caused material disruption because the city documented both directly. Ransomware confidence is medium because the malware incident involved unavailable records and demands from the perpetrators, but no reviewed source confirms encryption or a payment demand. Actor attribution and data impact remain unresolved.

Analytic gaps

The public record does not identify the malware family, initial access vector, compromised account or device, dwell time, persistence method, affected network segments, encryption activity or command-and-control infrastructure. It also does not establish whether information was accessed, copied, altered or removed; the demand terms or amount; payment; actor attribution; the end of the dispatch workaround; or the final recovery date.