Greenfield DDoS attack disrupts California internet

Analyst assessment

DysruptionHub assesses with high confidence that a large-scale distributed denial-of-service attack disrupted Greenfield Communications’ fiber network in Rancho Murieta and other California communities beginning July 12, 2026. Greenfield initially described a denial-of-service threat; later company statements reported by the River Valley Times characterized the event as a DDoS attack affecting portions of its network infrastructure and other providers’ networks.

Greenfield said engineers isolated affected network portions, implemented temporary workarounds, verified stability and restored customers in phases. Most customers were back online July 14, but network changes produced incorrect IP-geolocation information that continued to interfere with streaming applications and some remote-work security controls. On July 17, Greenfield said its main network was stable while it continued working with streaming providers on the remaining geolocation problems.

Operational significance

The attack left much of Rancho Murieta without internet, television and phone service for more than two days and affected homes, businesses and government operations. Greenfield later announced an automatic two-week internet-service credit for affected subscribers.

The Rancho Murieta Community Services District lost office phone service and normal utility-payment processing. Employees used cellular hotspots to reach email and shared files, while gate officers manually recorded visitor information because the ABDI visitor-management system was unavailable. Mechanical gates remained operational, water and wastewater plants were not affected, and district security reported no interruption to security services or notable security incident.

The Rancho Murieta Country Club also lost phone service and experienced payment and point-of-sale disruption. Staff used cellular hotspots on July 14 until Greenfield service returned. The outage therefore caused documented downstream effects across public administration, access-control, payment and commercial operations without interrupting electric power or the district’s treatment plants.

Disclosure posture

Greenfield’s first customer-wide email on July 13 described a large-scale DDoS attack. The company later acknowledged that its communications during the outage were limited and said it had restricted public detail while the attack was underway to avoid compromising its response. Greenfield subsequently described its restoration process, resiliency improvements and customer credit, and CEO Mike Powers responded in writing to follow-up questions from the River Valley Times.

The reported scope remains partly unresolved. Greenfield said other providers’ networks were affected, while an AT&T spokesperson told the newspaper that AT&T infrastructure had not experienced a disruption. The reviewed evidence does not establish whether Greenfield, an upstream provider or multiple networks were direct attack targets.

Current status

The incident is presumed resolved. Most service returned July 14, and Greenfield said its main network was stable July 17. Residual IP-geolocation problems still affected some applications and remote work on July 17, and no authoritative source provided a later final all-clear or precise time when every affected service normalized.

Confidence and uncertainty

Confidence is high that the incident was a DDoS attack because Greenfield directly characterized it that way and described network isolation, workarounds and phased recovery. Confidence is high in the documented downstream operational effects because the district and affected business representatives described specific service failures and contingency procedures.

The public record does not indicate ransomware or extortion and does not identify an attacker. Data confidentiality and integrity impacts remain unknown; no source reported unauthorized access, theft, alteration, encryption or publication. The outage and loss of access to shared files establish temporary data unavailability for authorized district users but do not imply a breach.

Analytic gaps

The reviewed sources do not establish the attacker, motive, botnet, traffic sources, command infrastructure, traffic volume, mitigation provider, exact geographic footprint, subscriber count or whether law enforcement was involved. They also do not resolve whether an upstream provider was targeted or when the remaining geolocation issues fully cleared.

No public source identifies unauthorized access, affected data categories, record counts, notifications, a ransom demand, DDoS extortion, payment or longer-term financial impact beyond Greenfield’s customer credit and temporary business disruption.