City of Suisun City
Malware disrupts Suisun City services
Summary
Malware compromised Suisun City’s IT systems Aug. 7, disrupting 911 routing, dispatch, records, payments and municipal services and forcing City Hall closures. All City Hall departments reopened to the public by Sept. 22, but full network restoration was still underway and city dispatchers continued using the Solano County dispatch center. Data impact, encryption, payment and actor attribution remained unresolved.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
DD-CIT assessment
The organization publicly identifies the event as cyber-related. The organization publicly documents the resulting service disruption.
Attack mechanisms
-
Malware
Malicious software other than ransomware used to compromise or disrupt systems.
Data impacts
-
Unknown data impact
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Operational impacts
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Payment processing disruption
The organization could not process, receive, issue, reconcile, or record payments normally.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Dispatch disruption
Dispatch, routing, assignment, coordination, or response-management functions were unavailable or materially impaired.
-
Emergency communications disruption
Emergency notification, public warning, radio, alerting, 911, or emergency coordination communications were unavailable or impaired.
-
Public safety operations disrupted
Police, fire, emergency medical, corrections, emergency management, or other public-safety operations were materially affected.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Facility closure
One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
-
Customer or public access restricted
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
Extortion indicators
-
Direct victim contact
The actor directly contacted the victim through a ransom note, email, chat portal, telephone call, messaging platform, or other communication channel.
Incident narrative
Analyst assessment
Suisun City experienced a malware attack Aug. 7, 2026, that compromised municipal IT systems and disrupted public-safety and government services. The city’s incident updates said malicious software infected city systems at about 5:45 a.m., prompting officials to shut down the network, activate the Emergency Operations Center and coordinate with federal, state and regional agencies.
DysruptionHub assesses with high confidence that malicious cyber activity caused the disruption. Ransomware involvement is assessed with medium confidence. Bay City News reported that the City Council planned to consider the city’s response to demands from the perpetrators, according to the City Manager’s Office. A councilmember separately characterized city records as being held hostage. That evidence establishes an extortion-related communication and makes ransomware likely, but it does not disclose the demand terms or confirm encryption.
Operational significance
The incident affected 911 routing, police and fire dispatch, records, online services and routine municipal operations. Dispatchers shifted 911 and nonemergency call handling to the Solano County dispatch center while Suisun City police officers and firefighters continued responding. City Hall closures limited in-person access to planning, building, housing, water, finance, human resources, public works and administration.
Recovery remained partial in late August. The city’s Aug. 25 update said the water counter was the only open City Hall service and could accept cash or check, but not credit or debit cards. Planning, building, housing, finance, human resources, public works, the City Manager’s Office and administration remained closed. Dispatchers continued taking calls through Solano County.
The city said Aug. 26 that it had moved the water-disconnection deadline from Aug. 26 to Sept. 2 because of operational adjustments. The notice continued to describe restoration and investigation as ongoing.
The city’s incident-update hub said Aug. 31 that the water-disconnection deadline was extended again to Sept. 23. Its Sept. 8 notice documented available online utility credit-card payments while the water and finance counter remained limited to cash or check. These channel-specific arrangements do not establish full network recovery.
Current status
Suisun City said Sept. 22 that public access had resumed across all City Hall departments, with regular schedules for municipal, housing, building, planning and police counters. The city said staff were still restoring full network operations, and city dispatchers continued to take 911 and nonemergency calls through the Solano County dispatch center. The incident therefore remained operationally active Sept. 22 despite the reopening. The city said its investigation of the attack and possible data effects also continued.
Research through Sept. 26 found no newer dated official recovery notice. The city’s undated FAQs distinguish separately hosted online permit and public-records portals and available recreation services from its internal-network disruption; their availability does not establish complete restoration or a later dated impact observation.
Disclosure posture
Suisun City promptly used cybersecurity language and disclosed the malware finding, approximate infection time, network shutdown, affected functions and agency coordination. Public reporting later revealed that officials were considering perpetrator demands, but the city has not publicly described those demands in its incident updates.
Confidence and uncertainty
Confidence is high that malware compromised the city network and caused material disruption because the city documented both directly. Ransomware confidence is medium because the malware incident involved unavailable records and demands from the perpetrators, but no reviewed source confirms encryption or a payment demand. The city reported Aug. 21 that it had found no indication of affected personal data at that point, while continuing its assessment. This preliminary finding does not rule out access or theft. Actor attribution and data impact remain unresolved.
Analytic gaps
The public record does not identify the malware family, initial access vector, compromised account or device, dwell time, persistence method, affected network segments, encryption activity or command-and-control infrastructure. It also does not establish whether information was accessed, copied, altered or removed; the demand terms or amount; payment; actor attribution; the end of the dispatch workaround; or the final recovery date.
Organizations involved
Impacted location
Sources
Our reporting documented that Suisun City declared a local emergency after malware disrupted 911 routing, police and fire dispatch, records, online services and internal operations. Dispatchers shifted call handling to Solano County while city police and firefighters continued responding; at publication, the city had not disclosed a demand, data impact or actor attribution.
The hub’s latest dated entry remains Sept.22: City Hall departments reopened but full network restoration and county dispatch continued. Historical Aug31 update extended water disconnects to Sept23; Sept8 confirmed online utility card payments and counter cash/check. Aug21 preliminary personal-data assessment found no indication of impact, with investigation continuing.
Bay City News reported that the City Council planned to consider Suisun City’s response to demands from the person or people behind the malware attack, attributing that description to the City Manager’s Office. A councilmember described city records as hostage. The report did not disclose the demands’ terms or identify the perpetrators.
The Los Angeles Times quoted City Manager Bret Prebula saying it could take until Halloween to restore all compromised systems and that the city did not know who was responsible. The report documented continuing City Hall disruption and the county-dispatch workaround.
Suisun City said its water counter reopened Aug. 18 but could accept only cash or check because credit and debit cards could not be processed. Eight other City Hall functions remained closed, and city dispatchers continued taking 911 and nonemergency calls through the Solano County dispatch center while restoration continued.
The city documented ongoing network restoration, open police lobby and water/finance counter, cash/check counter payments and available online utility credit-card payments.
FOX40 reported that Suisun City Hall reopened to the public Sept. 14 following the cyberattack.
The city said Sept. 22 that public access to all City Hall departments was available, but staff continued restoring full network operations and city dispatchers continued taking 911 and nonemergency calls through Solano County.
Bay City News, republished by SFGATE, reported Sept. 22 that all City Hall departments would reopen to public access and regular schedules while the malware investigation continued.
See something that needs correction?
Signed-in members can report an error, update, or missing source.