What Happened in Suisun City?
At 5:45 am on August 7, something went very wrong inside Suisun City’s IT network. Malicious software had infected the systems, and within hours, the city declared a state of emergency. The move wasn’t just symbolic — it unlocked access to state and federal resources that smaller municipalities often can’t reach on their own.
The fallout has been wide. The attack disrupted 911 call routing, police and fire dispatch, records management, and general city services. Officials made the call to shut down the entire IT network, a drastic step meant to contain the damage and preserve evidence for a federal investigation.
That decision has real consequences. Online services are offline, City Hall is closed, and in-person meetings across planning, housing, and water departments have been suspended indefinitely.
Is 911 Still Working in Suisun City?
Yes — but not through the usual channels. In an update posted on August 10, the city assured residents that police and fire crews are still responding to emergency calls. Those calls are now being routed through the Solano County dispatch center instead of the city’s own system.
Officials also stressed there is no “imminent” threat to the public from the incident itself. For a city of roughly 30,000 people in Northern California, that’s a small comfort, but a necessary one.
Is This a Ransomware Attack?
Nobody has officially confirmed it yet, but the signs point that way. Suisun City Council Member Princess Washington posted on LinkedIn late on August 10 that an emergency meeting would take place the following day to address the ongoing effects of the incident. The council planned to discuss “threats to public services and facilities, cybersecurity matters and anticipated litigation.”
More tellingly, SFGATE reported that the meeting would include consideration of the city’s response to demands from the “person or persons” behind the malware. When a city starts talking about responding to demands, ransomware is usually the reason.
A Wave of Attacks on Local Governments
Suisun City isn’t an isolated case. It’s part of a troubling pattern that has accelerated over the past few weeks.
- Coweta, Oklahoma (August 5): The city confirmed a “system-wide ransomware attack” and is working with cybersecurity experts to recover systems and assess whether any data was accessed.
- Washburn County, Wisconsin (August 6): Officials issued a press release confirming they’re responding to a cyber incident and shut down technology services as part of the response. No word yet on whether it’s ransomware-related.
- St. Paul, Minnesota (August 2025): The Interlock ransomware group published employee data online after the city refused to pay.
- Clay County, Indiana and Jackson County, Missouri (2024): Both reported ransomware attacks that disrupted critical government services.
These aren’t one-off events. They’re a trend.
Why Are Local Governments Such a Popular Target?
The answer is painfully simple: they’re vulnerable, and attackers know it.
Seemant Sehgal, Founder & CEO of BreachLock, put it bluntly. Municipal IT and security teams, he said, “operate under resource constraints that most enterprise security organizations would find genuinely difficult to imagine.” When three incidents hit in the same news cycle, he added, “it’s clear that attackers have figured that out.”
His assessment is worth sitting with: “Suisun City, Coweta, Washburn County – these are not outliers, they are a pattern.”
Local governments are expected to deliver essential services on tight budgets. Cybersecurity often takes a back seat to roads, schools, and public safety. That calculus is now coming back to bite.
The Cost of a Cyber Incident Goes Beyond Money
For a city like Suisun, the immediate costs are obvious — IT recovery, forensic investigations, potentially a ransom payment. But the hidden costs are just as damaging. Every day City Hall stays closed, permits don’t get processed. Housing meetings get postponed. Water department inquiries go unanswered.
Residents feel the disruption even if their personal data never leaks. And if data does leak, the consequences can linger for years. Just ask St. Paul, where employee information is still floating around on the dark web.
What Can Other Cities Learn From This?
If there’s a silver lining in incidents like these, it’s that they force conversations about preparedness. Cities that haven’t been hit should be paying close attention.
Key takeaways from the recent wave of local government ransomware attacks:
- Have a backup plan for 911 dispatch. Suisun was lucky to have Solano County as a fallback. Not every city does.
- Shut down fast. Taking the entire network offline is painful, but it preserves evidence and limits spread. Hesitation is costly.
- Communicate early and often. Suisun’s updates, while not detailed, at least kept residents informed about what to expect.
- Assume you’re a target. Small cities are not too small to be attacked. They’re often the perfect size — enough data to be valuable, not enough budget to defend it.
The reality is that cyber incidents in government agencies are no longer a matter of if, but when. The cities that recover best will be the ones that planned for that inevitability before the malware hit.
