Suisun City, California, declared a state of emergency Saturday after a cyberattack forced officials to take the city’s computer network offline.
The attack affected fire and police communications, including the routing of 911 calls. Officials have routed emergency police and fire calls through the Solano County dispatch center while cybersecurity experts work to restore city systems.
Download the Straight Arrow app today to get the stories that matter free from manipulation, bias or agenda.™
Point phone camera here
Officials have not publicly identified who carried out the Suisun City attack, whether public safety communications were specifically targeted or when the city’s network will be restored.
Officials said residents faced no imminent danger and that police, fire and other public safety services remained available. The city took its network offline to cut off the hack and preserve evidence for federal investigators.
About 30,000 people live in Suisun City, roughly 55 miles north of San Francisco. Officials believe this is the city’s first cyberattack of its kind.
As of Sunday morning, some online services and internal city functions were still offline.
Water system attacks under investigation
Separately, federal agencies are investigating cyberattacks involving municipal water systems across the country.
Straight Arrow previously reported that suspected Iran-linked cyberattacks affected more than 30 water systems in Minnesota before reports expanded to at least 12 states.
Late last month, the FBI, Environmental Protection Agency and Cybersecurity and Infrastructure Security Agency (CISA) said attackers had gained remote access to water and wastewater infrastructure in at least seven states.
CISA also warned that Iran-affiliated hackers were targeting internet-connected equipment that helps utilities run pumps, valves and other basic systems “to cause disruptive effects within the United States.”
U.S. intelligence agencies believe Iran’s Islamic Revolutionary Guard Corps is behind the water-system campaign, The Washington Post reported. The federal government has not made a formal accusation.
Why small systems are vulnerable
Smaller water utilities often rely on internet-connected automated equipment to operate and monitor their systems. That can include controls connected to pumps, valves, water pressure and other essential functions.
Internet-connected equipment can be vulnerable when systems use weak or default passwords or remain directly exposed online.
Cybersecurity varies widely across the nation’s more than 150,000 water systems. Some utilities keep critical systems disconnected from the internet, while smaller communities may lack the resources to make extensive cybersecurity upgrades.
Washington revisits water cybersecurity
The recent attacks have prompted new congressional proposals for water-system cybersecurity requirements.
Sen. Adam Schiff, D-Calif., introduced a bill last week that would directly authorize the EPA to regulate cybersecurity in the water sector. The measure would require water utilities to assess cyber risks and fix significant vulnerabilities.
The EPA tried a similar approach in 2023, but withdrew it after Republican-led states and industry groups sued. They argued the agency lacked authority and that smaller utilities would struggle with the cost.
Some industry groups are now calling for stronger standards. The American Water Works Association is urging Congress to create minimum cybersecurity requirements through an independent body overseen by the EPA.
States ask for federal backup
California officials said there is no evidence that the state’s water systems were part of the recent suspected Iran-linked attacks.
Gov. Gavin Newsom’s office argued that coordinated federal action would be more effective than state-by-state efforts.
“Cyber threats do not stop at state lines, and no state can defend against them alone,” the governor’s office said, according to the Los Angeles Times.
Newsom also announced a new AI Cyber Defense Program on Monday, saying California would expand cyber defenses for state agencies, local governments and critical infrastructure partners.
“The digital environment is rapidly evolving before our eyes,” Newsom said. “Attacks are faster, more sophisticated, and more frequent, putting at risk the basic systems families count on. California can either wait for the next crisis, or we can build the kind of defenses this moment demands. We are choosing to build.”
Round out your reading
- All your questions about napping, answered.
- Trump’s $5,000 promise echoes past payouts that never materialized.
- Inside the effort to make data centers pay their share of electricity costs.
- Why did the Feds seize the ’largest Martian meteorite on Earth’?
- Photos and video show exactly where and when Trump visited Ground Zero after 9/11.
