Suisun City's leaders unanimously declared a local state of emergency Saturday morning after malware tore through the city's computer network, disrupting 911 call routing and police and fire dispatch systems. The cybersecurity incident began around 5:45 a.m. Friday, according to city officials, prompting Suisun City to shut down its entire IT network in an effort to contain the threat and preserve evidence for a federal investigation.
The Suisun City Council held a special 11 a.m. meeting to formalize the emergency order, a legal step that unlocks mutual aid and expedited procurement under California law, according to CBS Sacramento. Suisun City dispatchers are now taking emergency calls through the Solano County dispatch center, a workaround that kept 911 service running even as the malware disrupted the city's own routing systems. Police officers and firefighters have continued responding to emergencies throughout the disruption, and city officials say there is no imminent threat to the public.
How the City Contained the Threat
Suisun City activated its Emergency Operations Center as part of its response, coordinating the shift of dispatch operations to the county system while its own networks stayed offline, per the City of Suisun City. Online city services and internal operations remained unavailable as of Saturday, and officials have not said how the malicious software entered the city's systems or who may be responsible. The cybersecurity incident remains under investigation, with cybersecurity experts working to determine its scope and restore affected systems.
Suisun City is working with the FBI and the Department of Homeland Security, along with the California Office of Emergency Services and other state and regional agencies, according to the same report. State law requires local agencies facing cyber incidents to coordinate with the California Cybersecurity Integration Center, a joint operation involving Cal OES, the California Department of Technology, the California Highway Patrol, and the California Military Department, per the State of California. The emergency declaration allows Suisun City to quickly access emergency resources and recover costs tied to the incident.
A City of 29,300 With Thin Police Staffing
Suisun City sits roughly 45 miles from both San Francisco and Sacramento in Solano County, a roughly 4.1-square-mile city of about 29,300 residents that serves as the gateway to the 84,000-acre Suisun Marsh, according to the U.S. Census Bureau. As of 2025, the city operated its police department with 0.9 officers per 1,000 residents, below the county average of 1.4, while still handling roughly 3,850 fire and medical calls annually, according to the city's own 2025 municipal overview. That staffing gap underscores the stakes of keeping dispatch functional even when internal networks go dark.
A June 2023 Solano County Civil Grand Jury report had already flagged that all seven cities in the county operated separate communications setups and recommended regional dispatch consolidation to improve emergency response efficiency, per the Superior Court of California, County of Solano. Suisun City's ability to lean on the Solano County dispatch center during this outage illustrates the kind of interagency reliance the report examined.
A Regional Pattern of Cyberattacks on City Halls
Suisun City's declaration follows a string of similar incidents across Northern California. In March, Foster City froze after a ransomware hit that forced a state-of-emergency declaration and pushed non-emergency operations offline while 911 dispatch kept running, according to CBS News. Back in February 2023, Oakland declared its own local emergency after a Play group ransomware attack disabled municipal networks and later resulted in 600 gigabytes of sensitive files published online, with full IT restoration there taking months, per CBS News.
Suisun City has launched a dedicated webpage, Suisun.com/CybersecurityUpdates, and designated city representatives Michael Elm and Ashley Esparza as public information contacts to issue advisories while the city's primary phone lines remain down. Officials have not said whether any resident or employee data was exfiltrated in the attack, and that question, along with how the malware entered city systems in the first place, remains unresolved as the investigation continues.
