Malicious software hit Suisun City’s IT network at approximately 5:45 a.m. on Friday, February 9, 2024. The Northern California municipality lost 911 routing, police and fire dispatch capabilities, city records access, and virtually every digital service connecting government to the public. Emergency calls shifted to the Solano County Sheriff’s Office dispatch center, and officials stressed that police and fire services remained operational — but the disruption to normal operations was immediate and total.
This matters beyond one small city. Smaller municipalities run lean IT operations with limited redundancy, and federal agencies have been warning for months that local infrastructure sits squarely in the crosshairs.
What Actually Went Down
City officials shut down the entire network to stop the spread and preserve evidence — and by Saturday, the City Council had declared a state of emergency.
Officials took down the full IT network both to contain the threat and to protect the integrity of a federal investigation. The emergency declaration, voted on Saturday, February 10, unlocks access to state and federal support resources and allows the city to seek reimbursement for incident-related costs.
Here’s what the situation looked like as of Sunday morning:
- Full IT network remained offline, including all online city services
- 911 calls continued routing through Solano County Sheriff’s Office dispatch
- The FBI, Department of Homeland Security, and California Office of Emergency Services were all involved
- Internal city operations — permits, billing, records — stayed dark
- Officials had not yet determined whether any data was stolen
City Manager confirmed in broadcast reporting that the scope of potential data exposure remained unconfirmed: “We don’t know if any data has been taken from our system.”
What Nobody Knows Yet
The attack vector, the threat actor, and the question of data exfiltration all remain unanswered — and the list of involved federal agencies signals this is anything but routine.
The attack vector is a mystery. The threat actor is unidentified. Whether sensitive data left the building — also unknown. The FBI, DHS, and California OES don’t mobilize together for a minor IT hiccup.
The pattern is familiar to federal regulators. The Colonial Pipeline ransomware attack in 2021 demonstrated that critical infrastructure — pipelines, hospitals, municipal networks — can unravel when a single compromised node cascades through every connected service. Suisun City joins a growing list that includes hospitals, water treatment facilities, and school districts, where a cyberattack isn’t just an inconvenience but a direct public safety event.
Federal warnings about cyber threats to municipal water and wastewater systems grew louder throughout 2024, with the EPA, CISA, and FBI issuing advisories urging facilities to strengthen defenses. Suisun City is now another data point in that trend.
For residents, the practical reality is this: emergency services are working, but the city’s digital front door is locked from the inside. The restoration timeline remains unclear, and whether personal data was compromised sits unanswered. Track updates through official city channels — once those channels come back online.
