---
title: "Suisun City malware incident and network shutdown"
description: "Suisun City’s August 7, 2026 malware incident, network shutdown, dispatch continuity and emergency declaration."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-07"
canonical_url: "https://www.ally.security/incidents/suisun-city-malware-incident-2026"
markdown_url: "https://www.ally.security/incidents/suisun-city-malware-incident-2026.md"
stix_url: "https://www.ally.security/incidents/suisun-city-malware-incident-2026/stix.json"
---

# Suisun City malware incident and network shutdown

Malware compromised city IT. A network shutdown disrupted services while dispatchers continued taking emergency calls through Solano County.

Last modified Oct 7, 2026 · 2 sources

## Summary

- **Environment:** Municipal IT, dispatch and city-service systems
- **Operational impact:** Network shutdown; payments and permits affected
- **Financial impact:** No quantified loss in the retained evidence

## What happened

[Suisun City](https://www.suisun.com/) reported that malware compromised its IT systems at roughly 5:45 a.m. on August 7, 2026. Its [official notice](https://www.suisun.com/News-articles/Suisun-City-Council-Declares-State-of-Emergency-in-response-to-Cybersecurity-Incident) described a network-wide shutdown. [2](#source-2)

## Impact

- City systems supporting 911 routing, dispatch and records were affected; dispatchers took calls through Solano County while police and fire continued responding. [2](#source-2)
- A city spokesperson told [KQED](https://www.kqed.org/news/12094482/suisun-city-declares-state-of-emergency-after-cyberattack) that emergency calls continued while residents faced payment and permit disruption. [1](#source-1)

## Timeline

### August 7, 2026 — Malware incident begins

The city dated the compromise to Friday morning. [2](#source-2)

### August 8, 2026 — Emergency declared

The [council announcement](https://www.suisun.com/News-articles/Suisun-City-Council-Declares-State-of-Emergency-in-response-to-Cybersecurity-Incident) followed a special meeting. [2](#source-2)

### October 7, 2026 — Briefing updated

This briefing was last reviewed and updated on October 7, 2026.

## Threat Group & Attack Vector

The city described malicious software. The retained record does not establish an initial access method, ransomware family or confirmed data exposure. [2](#source-2)

### Actors

- No threat actor group has been identified in the retained evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

The shutdown aimed to contain the threat and preserve evidence. The city activated its Emergency Operations Center and coordinated with federal, state and regional agencies. [2](#source-2)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/suisun-city-malware-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Suisun City Declares State of Emergency After Cyberattack

news · KQED · Aug 9, 2026

<https://www.kqed.org/news/12094482/suisun-city-declares-state-of-emergency-after-cyberattack>

<a id="source-2"></a>

### Suisun City Council Declares State of Emergency

official · City of Suisun City · Aug 8, 2026

<https://www.suisun.com/News-articles/Suisun-City-Council-Declares-State-of-Emergency-in-response-to-Cybersecurity-Incident>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Suisun City malware incident and network shutdown: The city activated its Emergency Operations Center and coordinated with federal, state and regional agencies.
2. **Occurred At · 100% confidence · current**  
   City council declares a state of emergency: 2026-08-08
3. **Resulted In · 100% confidence · current**  
   Suisun City malware incident and network shutdown: Suisun City said malware compromised its IT systems and affected 911 routing, dispatch, records and city services.
4. **Resulted In · 100% confidence · current**  
   Suisun City malware incident and network shutdown: KQED reported the city spokesperson saying emergency calls continued while payment and permit services were affected.
5. **Resulted In · 100% confidence · current**  
   Suisun City malware incident and network shutdown: City dispatchers took calls through Solano County while police and fire continued responding.
6. **Affected Organization · 100% confidence · current**  
   Suisun City malware incident and network shutdown: City of Suisun City
7. **Began At · 100% confidence · current**  
   Suisun City malware incident and network shutdown: 2026-08-07
8. **Resulted In · 100% confidence · current**  
   Suisun City malware incident and network shutdown: City council declares a state of emergency
9. **Resulted In · 100% confidence · current**  
   Suisun City malware incident and network shutdown: The city shut down its IT network to contain the threat and preserve evidence.

</details>