Hackers Crippled a California City’s 911 System. Its IT Budget Was Already the Smallest Line Item.
- $1,300,000 the structural budget shortfall Suisun City faced for fiscal year 2025-26 before hackers ever touched its network — Daily Republic, budget coverage
- 50-70% the capacity city departments reported operating at amid that shortfall, months before the Aug. 7 malware attack — Daily Republic, budget coverage
- 97% the share of Measure S's voter-approved revenue earmarked for police and fire, leaving only “the remainder” for dispatch and IT needs — Daily Republic; Measure S accounting
- $10,000 the performance bonus City Manager Bret Prebula voluntarily forwent in June 2025, citing the city's “current financial challenges” — Daily Republic, June 2025
- 0 ransomware groups that have claimed responsibility and ransom demands publicly reported, as of this writing — CBS News Sacramento; NBC Bay Area
Suisun City is a Solano County town of roughly 30,000 people tucked between San Francisco and Sacramento — the kind of place most Californians couldn’t point to on a map until early Friday morning, Aug. 7, 2026, when malware infected and compromised its municipal computer systems. City officials shut down the entire network as a fail-safe, both to contain the threat and to preserve evidence for what is now a federal investigation.
The outage hit everything running on that network at once: 911 call routing, police and fire dispatch, city records, and online services including utility bill payment. Dispatchers rerouted 911 calls through the Solano County dispatch center under mutual-aid agreements, and police and fire personnel kept responding to calls in the field throughout. By Saturday morning, the City Council held a special session and voted unanimously to declare a local state of emergency.
City officials have been consistent on one point across every outlet that has covered this: “There is no imminent threat to the public,” and “all public safety services remain active.” What the city has not said is whether any resident or employee data was stolen, or who is responsible. Those questions remain open, and this piece treats them as such throughout.
The intrusion was detected around 5:45 to 6:00 a.m. on Friday, Aug. 7. Rather than try to isolate individual compromised machines while the malware kept spreading, the city pulled the plug on its network entirely — a blunt but standard incident-response move that trades short-term disruption for containment and a clean forensic trail. That trade-off took down 911 call routing along with everything else running on city infrastructure, forcing Solano County’s dispatch center to absorb Suisun City’s emergency calls through existing mutual-aid channels while local police and fire crews continued responding to incidents in person.
The Council’s special session came the next day, Saturday, Aug. 8, at 11:00 a.m., presided over by Mayor Alma Hernandez — a California Democratic Party Region 3 delegate for Rep. John Garamendi’s district, though Suisun City’s mayoral office is itself officially nonpartisan. The council’s unanimous vote declared a local emergency, a step that unlocks state and federal disaster resources and gives the city legal cover to fast-track emergency IT contracts without the normal bidding process. City Manager Bret Prebula announced that residents who couldn’t pay utility bills online because of the outage would not be charged late fees. As of this writing, the city has not said whether data was exfiltrated, and no ransomware group has claimed responsibility or issued a ransom demand.
Hackers didn’t pick a well-funded target. Suisun City went into the current fiscal year carrying a structural budget shortfall of $1,300,000 for FY2025-26, and city departments reported operating at just 50 to 70 percent capacity as they absorbed the resulting cuts — a strain that predates Friday’s attack by months, not days. That’s the fiscal backdrop the malware landed in: a city government already stretched thin trying to keep basic services running before anyone touched its network.
The strain wasn’t hidden. In June 2025, City Manager Prebula voluntarily turned down his own $10,000 performance bonus and a cost-of-living raise, citing the city’s “current financial challenges” — a real, on-the-record data point that the person overseeing the eventual cyberattack response had already flagged the city’s budget as too tight to justify his own raise, more than a year before the malware hit.
Voters actually tried to fix this. Measure S, approved by 72 percent of Suisun City voters in 2024, generates $6,890,000 a year. But 97 percent of that revenue is earmarked for public safety personnel — 57 percent to police, 40 percent to fire — leaving only the remainder, the smallest slice of the pie, for everything else, including the dispatch and IT infrastructure that now sits at the center of this emergency. Voters funded more officers and firefighters. They did not fund the network those officers and firefighters depend on to get a 911 call in the first place.
That imbalance isn’t unique to Suisun City’s IT department — the same fiscal squeeze shows up in staffing across city government generally, as ABC10 reported even before this attack:
That segment is about general understaffing across city departments, not the cyberattack itself — but it’s the same underlying story: a local government asking every department to do more with structurally less, months before hackers found the weakest link in the chain.
The FBI, the Department of Homeland Security, and the California Office of Emergency Services (Cal OES) are all involved in the response. None has publicly attributed the attack to a specific group or actor, and no ransomware gang has posted a claim of responsibility on its leak site — the usual way these groups announce themselves and pressure victims to pay. No ransom demand has been reported, and the city has not disclosed any estimated recovery cost. Until investigators say otherwise, this remains an alleged intrusion under active investigation, not an attributed attack.
Suisun City sits within the district of Rep. John Garamendi (D-CA), whose office had not issued a public statement on the attack as of this writing. The story drew national attention beyond the Bay Area outlets covering it locally, including a national write-up from the New York Post on Aug. 8-9. What every account agrees on is the timeline: malware Friday morning, a full network shutdown, mutual-aid 911 rerouting, and a unanimous emergency declaration by Saturday — all against a budget that had already been cut to the bone before a single byte of malicious code arrived.
Malware knocked out Suisun City’s 911 routing, dispatch, records, and online services on Aug. 7, 2026, forcing a full network shutdown and a unanimous City Council vote the next day to declare a local state of emergency. No attacker has been identified, no ransom demand has been reported, and it isn’t yet known whether data was stolen — the FBI, DHS, and Cal OES are still working the case. What is already documented is the fiscal backdrop: a $1,300,000 structural budget shortfall, departments running at 50 to 70 percent capacity, a city manager who turned down his own $10,000 bonus citing money troubles, and a voter-approved public-safety measure that sent 97 percent of its revenue to police and fire salaries while dispatch and IT infrastructure split whatever was left over. The hackers didn’t find a fluke. They found the smallest line item in the budget.
