Cyber Incident Victim: Suisun City
Timeline
Summary
Suisun City declared a state of emergency after a cyberattack compromised its information technology systems, affecting critical public safety operations such as 911 routing, police and fire dispatch, records, and city services. The city shut down its network to contain the threat and preserve evidence, while dispatchers handled calls through the county center and public safety personnel continued responding to incidents, with assistance from federal and state agencies investigating the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 0 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
At about 5:45 a.m. Friday, malicious software infected and compromised the city's information technology systems. The cybersecurity incident impacted critical public safety operations, including 911 routing, police and fire dispatch, records, and city services. The city announced via social media that there was no imminent threat to the public and that all public safety services remained active. To contain the threat and preserve evidence for a federal investigation, the city shut down its computer network. The city began working with the FBI, the Department of Homeland Security, and the California Office of Emergency Services to investigate the incident and restore systems.
At a special meeting on Saturday morning, the Suisun City Council declared a state of emergency, enabling the city to access emergency support services and recoup costs associated with the cybersecurity incident. While the network was offline, Suisun City dispatchers handled calls for service through the Solano County dispatch center. Police officers and firefighters continued to respond to calls for service despite the disruption. Online city services and internal operations remained unavailable during the network shutdown. The city continued its efforts to investigate the attack and restore normal operations.