Suisun City, California, declared a state of emergency Saturday after a malware attack disrupted 911 routing, police and fire dispatch, and other city systems.

 

What happened

The cybersecurity incident began around 5:45 a.m. August 7. City officials shut down the entire IT network to contain the threat and preserve evidence for a federal investigation. Police officers and firefighters continued responding to emergencies despite the disruption, and Suisun City dispatchers began routing calls through the Solano County dispatch center. Officials said the public faces no imminent threat. As of Saturday, many online city services and internal operations remained unavailable while cybersecurity experts investigated the incident and worked to restore affected systems. The Suisun City Council unanimously declared a state of emergency Saturday morning, a move that allows the city to quickly access emergency resources and recover costs tied to the incident. The city is working with the FBI, the Department of Homeland Security, the California Office of Emergency Services, and other state and regional agencies. Officials have not disclosed how the malware entered city systems or who may be responsible.

 

The backstory

Suisun City isn't the first US city to see 911-adjacent systems knocked out by an attack. In 2023, the City of Dallas, Texas suffered a ransomware attack, later claimed by the Royal ransomware gang, that compromised city servers and took down the Dallas Police Department's website. The attack disrupted the Computer-Aided Dispatch (CAD) systems dispatchers and 911 operators use to prioritize and record incident calls, forcing call takers to manually write down instructions for responding officers. As in Suisun City, Dallas officials said 911 calls themselves continued to be dispatched and that police response was not affected. The attackers left ransom notes on city printers threatening to publish the encrypted data online if a ransom demand went unmet.

 

What was said

Suisun City officials said in a statement that the cybersecurity incident began around 5:45 a.m. Friday and that the city "shut down its entire IT network to contain the threat and preserve evidence for a federal investigation."

 

Why it matters

This incident shows how a malware attack can reach systems people rely on in life-or-death situations. The city's decision to shut down its entire network, rather than isolate a smaller portion, shows how difficult it can be to contain a threat to a single system once it's inside municipal infrastructure. The involvement of the FBI, DHS, and California's Office of Emergency Services also signals that local governments need state and federal cybersecurity support to respond to and recover from these attacks.

 

The bottom line

Suisun City's emergency declaration lets the city move faster on recovery and cost recovery, but the facts about how the malware got in and who is responsible are still unknown. The incident is a reminder that public safety infrastructure is a target, and that having a backup plan, like Solano County's dispatch center, can be the difference between a disrupted network and a public safety failure.

 

FAQs

Can malware take down a 911 system?

Malware can infect the computer networks that route 911 calls and support dispatch, forcing cities to shut down or reroute those systems until the threat is contained.

 

Why would a city shut down its IT network instead of just the affected part?

Isolating a threat to one system is difficult once malware is inside a network, so cities often take everything offline to contain the spread and preserve evidence.

 

What happens to 911 calls if a city's dispatch system goes down?

Cities can reroute 911 calls through a neighboring county or regional dispatch center so emergency response continues.

 

Why do cities declare a state of emergency after a cyberattack?

A state of emergency gives a city faster access to emergency funding and resources and a path to recover costs tied to the incident.