Suisun City 911 dispatch taken down in ransomware attack
Suisun City is one of at least five municipalities across four states that lost public-safety and government services to cyberattacks in the same week, and the pattern isn't new.
TL;DR
Suisun City, California, shut down its entire IT network Friday after ransomware hit critical systems including 911 routing, police dispatch, and city records. The city declared a state of emergency. The same week, Coweta, Oklahoma; Mitchell, South Dakota; Coryell County, Texas; and Washburn County, Wisconsin disclosed cyberattacks disrupting government services. Emergency calls in Suisun City are now routed through the county dispatch center, and the FBI is investigating.
The attack on Suisun City is the sharpest in a cluster that keeps repeating: a municipality of a few tens of thousands of people, no dedicated security operations center, and critical infrastructure (911 routing) that lives on the same network as routine municipal IT. When the ransomware hit, everything went dark. City hall closed. Departments shuttered. 911 calls now bounce through the county. The FBI's on scene, and a state of emergency unlocks recovery funding.
That's the Monday-morning reality for the practitioner tasked with getting these systems back online. Offsite backups exist, but the network has to be scrubbed before anything gets restored. In Coweta, that means no credit card payments for utilities in person. In Mitchell, county officials were told not to open email from city government. In Washburn County, court phone and fax lines are still dead, though e-filing survived.
None of this is novel. The Record has documented municipal ransomware clusters in at least March 2025, June 2024, and January 2025, different states, same playbook. Winona County, Minnesota, got a National Guard deployment in April 2026 after its second ransomware attack in three months overwhelmed commercial response capabilities. The Massachusetts Patriot Regional Emergency Communications Center lost non-emergency lines to a cyberattack just this April.
What's striking is how little the recovery playbook has changed. Networks get taken offline. Third-party payment portals survive because they're hosted elsewhere. Offsite backups get tapped. Federal law enforcement gets notified. And the public is told (reliably) that 911 and emergency response are "unaffected," even when, as in Suisun City, the 911 routing itself was compromised and only restored through county-level workarounds. That phrase has become a municipal cyber-incident tic, and it doesn't always mean what residents would assume.
The water-sector attacks that have hit at least 12 states add another layer: these aren't separate problems. The same municipalities struggling with ransomware are often the ones operating water treatment, utility billing, and emergency dispatch on shared infrastructure.
Published ·Deep Fathom