"Suisun City, Coweta, Washburn County – these are not outliers, they are a pattern." — Seemant Sehgal, Founder & CEO, BreachLock
Suisan City’s emergency, what was disrupted, and the timeline
Suisan City declared a state of emergency after its IT network was infected by “malicious software” at roughly 5:45 am on August 7. The declaration, the City said, enables access to emergency resources and support at state and federal levels. The attack forced the authority to shut down its entire IT network to contain the threat and preserve evidence for a federal investigation.
The shutdown has left online services and internal operations temporarily unavailable. City Hall is closed and in-person meetings across departments — including planning, housing and water — are affected. The incident has also impacted 911 call routing, police and fire dispatch, records and City services.
Emergency response and continuity for 911, police and fire
In an update posted on its website on August 10, Suisan City assured residents that police and fire services are able to continue responding to emergency 911 calls. Those calls are being routed through the Solano County dispatch center. The City also stated there is no “imminent” threat to the public from the incident.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageRansomware indications and the city council’s response
There are indications the incident may be ransomware-related, though the City has not officially confirmed the source or the perpetrators. On August 10, Suisan City Council Member Princess Washington posted that an emergency meeting would take place on August 11 to address the continuing effects of the cybersecurity incident. Washington said the Council will consider convening a closed session to “receive information and provide direction regarding threats to public services and facilities, cybersecurity matters and anticipated litigation.”
California-based news website SFGATE was reported to say the emergency meeting would consider the City’s response to demands from a “person or persons” behind the malware attack.
Other local governments hit in the same period
Suisan City’s incident comes amid a spate of recent attacks on U.S. local authorities. On August 5, 2026, the City of Coweta in Oklahoma revealed it had experienced a “system-wide ransomware attack” and said it was working with cybersecurity experts to recover systems and assess whether any data was accessed. On August 6, 2026, Washburn County in Wisconsin issued a press release confirming it was responding to a cyber incident and had shut down its technology services as part of the response; no further details were provided publicly about whether that incident was ransomware-related.
The report also notes earlier, high-impact cases: in August 2025 officials from the City of St. Paul, Minnesota, confirmed the Interlock ransomware group published employee data online after payment demands were refused. In 2024, Clay County in Indiana and Jackson County in Missouri reported ransomware attacks that impacted critical government services.
What this means for technologists, policymakers, and residents
- Technologists and security teams: The Coweta response — working with external cybersecurity experts — and Suisan City’s full shutdown to preserve evidence illustrate two immediate actions municipal teams are taking when networks are compromised. As Seemant Sehgal observed, municipal IT and security teams commonly face resource constraints, and multiple incidents in a short window have drawn attention to operational limits at the local level.
- Policymakers and local officials: Suisan City’s state-of-emergency declaration shows one legal and administrative lever local governments use to access state and federal support after an attack. The planned council closed session to receive briefings about “threats to public services and facilities, cybersecurity matters and anticipated litigation” signals that elected bodies are treating cyber incidents as both operational crises and potential legal matters.
- Residents and the public: For now, the City has communicated that emergency services continue via Solano County dispatch and that there is no “imminent” public threat. At the same time, closures of City Hall and the unavailability of online services mean routine civic business and in-person meetings are disrupted.
The string of recent incidents — and the language used by both local officials and outside experts — frames these events as part of a wider pattern of attacks affecting municipal infrastructure. Suisan City’s next steps include the August 11 emergency council meeting and any determinations made there about responding to demands and pursuing litigation; meanwhile, the City is preserving evidence for a federal investigation.
