Key Takeaways
- Suisun City declared a state of emergency after a cyberattack forced the shutdown of its municipal IT network.
- The attack disrupted fire and police communications, including 911‑call routing, but officials said public safety remained active and there was no imminent threat to residents.
- City dispatchers are now handling emergency calls through the Solano County dispatch center while cybersecurity experts investigate and work to restore systems.
- The incident is believed to be the first of its kind in Suisun City and reflects a growing trend of cyber threats targeting essential local services nationwide.
- Federal agencies have warned that Iran‑affiliated hackers are increasingly targeting internet‑connected industrial controllers in water and wastewater systems across multiple states.
- Small communities often lack the resources to secure such automated systems, as demonstrated by a recent cyberattack that caused dramatic water‑level drops in thirty Minnesota systems before backup measures kicked in.
- A bipartisan group of lawmakers is urging the restoration of federal funding for Department of Homeland Security programs that coordinate multi‑state cybersecurity efforts.
- California’s governor’s office stressed that state‑by‑state defenses are insufficient and warned that federal cuts to cybersecurity workforce and programs weaken the nation’s ability to protect essential services.
Suisun City Declares State of Emergency After Cyberattack
On Saturday, the Suisun City council voted to declare a state of emergency after a cyberattack compromised the municipality’s information technology network. The intrusion forced city officials to shut down the entire IT infrastructure to contain the malicious activity and preserve evidence for a forthcoming federal investigation. While the attack disrupted several internal systems, city leaders emphasized that the declaration was a precautionary measure aimed at protecting public safety and facilitating a coordinated response. The decision underscores the growing recognition that even relatively small municipalities can become targets of sophisticated cyber threats that jeopardize critical operations.
Impact on Public Safety Communications and 911 Services
The cyberattack specifically affected the communication systems used by Suisun City’s fire and police departments, including the routing of 911 emergency calls. Dispatchers reported that normal call‑handling pathways were impaired, raising concerns about response times. However, officials quickly assured the public that there was no imminent danger and that all essential public‑safety services remained operational. By rerouting emergency communications through alternative channels, the city sought to maintain continuity of response while the underlying network remained offline.
Containment Measures and Ongoing Investigation
To prevent the threat from spreading and to safeguard potential forensic evidence, Suisun City officials ordered an immediate shutdown of the affected IT network. This containment step allowed federal cybersecurity investigators to begin examining the attack vectors without risking further compromise. City dispatchers have since been handling emergency police and fire calls through the Solano County dispatch center, a temporary arrangement that ensures 911 calls are still answered and routed appropriately. The shutdown remains in place as experts work to isolate the malware, identify the attackers, and gather intelligence for possible prosecution.
Current Status of City Services and Restoration Efforts
As of Sunday morning, online city services and many internal municipal operations remained unavailable while cybersecurity specialists continued their investigation and restoration work. Residents attempting to access utility billing, permit applications, or other digital platforms encountered service interruptions. The city has communicated regularly with the public, providing updates on progress and advising residents to use non‑digital channels for urgent needs. Restoration efforts are prioritizing critical systems first, with the goal of returning full functionality as soon as the network is deemed secure and verified by federal authorities.
Significance of the Attack in a Growing Threat Landscape
Suisun City’s experience is believed to be the first known cyberattack of its kind in the municipality, which has a population of roughly 30,000 and lies about 55 miles north of San Francisco. The incident highlights a broader, escalating trend in which cyber adversaries target the information technology that underpins essential local services—such as emergency communications, water treatment, and power distribution. As these systems become increasingly interconnected and reliant on internet‑based controls, they present attractive targets for actors seeking to cause disruption, gather intelligence, or test new attack methodologies. The Suisun City case serves as a stark reminder that no community, regardless of size, is immune to such threats.
Federal Warnings About Iran‑Affiliated Threats to Water Systems
In late [Month], the Federal Bureau of Investigation (FBI), the Environmental Protection Agency (EPA), and the Cybersecurity and Infrastructure Security Agency (CISA) jointly issued a warning that cyberattackers had remotely accessed online infrastructure for water and wastewater systems in at least seven states. The agencies attributed these intrusions to hackers believed to be affiliated with Iran, noting that the actors were targeting internet‑connected industrial controllers “to cause disruptive effects within the United States.” The alert emphasized that such attacks could manipulate treatment processes, interfere with supply levels, or even threaten public health if successful. The warning underscored the need for heightened vigilance among utilities that rely on networked operational technology.
Vulnerabilities of Small‑Community Water Infrastructure
Many smaller municipalities depend on automated, internet‑enabled control systems to manage water treatment, pumping, and distribution. These systems often lack robust cybersecurity defenses due to limited budgets, insufficient technical expertise, and outdated hardware. A recent cyberattack on thirty water systems in Minnesota illustrated the potential consequences: attackers caused dramatic drops in water levels before backup systems engaged, demonstrating how a successful intrusion can quickly escalate into a service‑disrupting event. The incident highlighted a critical gap—while larger utilities may invest in sophisticated security programs, smaller communities frequently remain exposed, making them attractive low‑hanging fruit for cyber adversaries.
Legislative Response Calls for Renewed Federal Cybersecurity Funding
In response to the rising tide of attacks on municipal infrastructure, a bipartisan group of lawmakers last week urged Congress to restore federal funding for Department of Homeland Security (DHS) programs designed to coordinate multi‑state cybersecurity initiatives. These programs facilitate information sharing, provide technical assistance to state and local entities, and support joint exercises that improve preparedness across jurisdictional boundaries. Legislators argued that reinvesting in these capabilities is essential to counter the evolving threat landscape and to ensure that communities like Suisun City receive the resources needed to defend against sophisticated cyber campaigns.
California’s Position and the Need for Coordinated Federal Defense
The office of Governor Gavin Newsom stated that, to date, there is no evidence that California’s water systems were among those targeted in the recent spate of attacks attributed to Iran‑affiliated actors. Nevertheless, the governor’s office warned that relying solely on state‑by‑state defenses is insufficient in the face of cyber threats that transcend geographic borders. In a statement to The Times, the office emphasized: “Cyber threats do not stop at state lines, and no state can defend against them alone. Federal cuts to the nation’s cybersecurity workforce and critical programs have weakened the partnerships, threat intelligence, and technical support that help protect essential services across the country. Reducing these capabilities while cyber threats continue to grow leaves every state, and the nation, less prepared for the next attack.” The comment underscores a growing consensus that a robust, federally coordinated approach is indispensable for safeguarding the nation’s critical infrastructure.