No one, it seems, knows why cyberattackers would target Suisun City, a sleepy, marsh-front suburb of 29,000 people on the northeast outskirts of the San Francisco Bay Area.But target it, they did, with crippling effects. Whoever they are.Before sunrise on Aug. 7, the city’s information technology network was infected by malicious software that hit critical public safety operations, including police and fire dispatch and critical records, officials say. It could be Halloween before all compromised systems are fully restored, said City Manager Bret Prebula, who added that it is unclear who the bad actors are. City Manager Bret Prebula says it could take months before computer systems are fully restored. “The hard part of this,” he said, “is we may never know the ‘why.’”Suisun City has scrambled in the wake of the attack. It shut down its entire IT department. The City Council declared a state of emergency. Its glass-domed City Hall was closed for a week. And municipal 911 dispatchers moved to the Solano County dispatch center in neighboring Fairfield. The breach is the latest blow to a struggling small city that has faced years of severe budget deficits, pushing it to the brink of insolvency, as well as chronic understaffing in its police, fire and other municipal departments. Prebula worries about burnout among staffers, who are handling the crisis on top of their daily workload.“It’s like a duck on the pond,” he said. “It’s going to look calm to the community because it’s our job to deliver those services in these times. But we are moving in various directions under the water that no one sees. Staff is having to do probably twice the amount of work to get the same things done.” City officials say the U.S. Department of Homeland Security and the FBI are investigating. The Department of Homeland Security did not respond to requests for comment. And the FBI office in Sacramento — in true FBI fashion — said in an email that it was “unable to confirm or deny the existence of an investigation.” There’s a whole lot of intrigue in Suisun City. But not a lot of answers. Baffled residents, who don’t know whether their data have been stolen or compromised, have been trying their best to fill in the blanks. Joan Pivarnik, 72, was working on a 2,000-piece Disney jigsaw puzzle and binge-watching the BBC documentary series “Queens That Changed the World” on Aug. 8 when a friend called to ask if she had heard about the hack. She hadn’t.“I was like, ‘Whaaaat?!’” said Pivarnik, a grandmother of four. “So, I called 911 here in Suisun and said, ‘Is this real or is this a hoax?’”The dispatcher told her it was indeed very real and that emergency calls were being rerouted to the county.“I’m just kind of shocked that it’s happening here in Suisun,” Pivarnik said. “I thought no one knew of us. We are vulnerable. What do we have? We don’t have anything.”Pivarnik moved to Suisun City in 2008, drawn by “a very cute, affordable apartment” for rent. Sure, the city has its financial problems, she said, but it’s “a quaint, lovely little town” that has come a long way since the 1980s and 1990s, when crime was rampant, and the place was truly run-down. (Back then, City Hall operated from a trailer with its own DMV-registered license plate, and the San Francisco Chronicle rated the city as the worst place to live in the Bay Area.) Pivarnik worries about her personal data being stolen in the breach, noting: “It’s not like I have money. But I have my livelihood.”Her friend, Russell Dorsey, was scrolling YouTube last weekend when a video from a Houston-based commentator popped up with an eyebrow-raising title: “BREAKING / U.S. CITY SHUTDOWN!! FBI Investigates New Attack (State of Emergency).” The thumbnail image showed a red skull, a power transmission tower — and an Iranian flag. The host, who asked viewers to “drop praying hands” emojis in the comments to support all those affected by the hack, cited a California Post article with a headline about “chaos” in Suisun City. 1 2 3 1. A closed notice is displayed on the door of City Hall. 2. The Suisun City Fire Department. 3. The Suisun City police station. Dorsey, an electrical contractor and retired master sergeant who served with the U.S. Air Force and Navy, said there was no palpable chaos and that, for days, most residents weren’t even aware of the issue. He was amused by the national attention and the assumption that Iran was behind the cyberattack. “I’m like, ‘Really? Why would Iran care about Suisun?” said Dorsey, 58, who joked that “I don’t think any Iranian wants my credit card information.”Going after internet technologies that control communications within public safety agencies would be a new frontier for cyberattackers, including those that federal agencies believe could be affiliated with Iran.In late July, the FBI and Environmental Protection Agency warned that cyberattackers had remotely accessed online infrastructure for water and wastewater systems in at least seven states, and the Cybersecurity and Infrastructure Security Agency warned that “threat actors are targeting water entities of all sizes.”Water systems in smaller communities often rely on internet-connected automated systems, with many lacking the resources to provide adequate security. More than 30 systems in Minnesota were affected by a coordinated cyberattack last month. The Suisun City attack did not impact the local water system, said Michael Elm, a city spokesman. The city facilitates billing, but water is provided by a separate, unaffected entity: the Suisun-Solano Water Authority, a joint powers authority between the municipality and the Solano Irrigation District. Katrina Garcia, a City Council candidate. In a statement, the California Governor’s Office of Emergency Services said it was working closely with Suisun City officials and federal agencies to respond to the crisis.“This event is part of a growing trend of cyber attacks, particularly AI-driven attacks, that are becoming faster and more sophisticated,” the statement read. “As this threat grows, California is bolstering its defenses accordingly.”In March, a cyberattack briefly paralyzed municipal systems and prompted an emergency declaration in Foster City, a Bay Area suburb of 32,000 people. In response to questions from The Times about whether the breach remained under investigation or the attacker had been identified, Austin Walsh, a Foster City spokesperson, said the city would not comment. In Suisun City, the attack — and the lack of answers about what or who caused it — comes at a time when townsfolk already are primed to be suspicious. Multiple residents told The Times that they fear the cyberattack is somehow linked to the only other thing that seems to garner headlines about Suisun City: a high-profile plan by a company called California Forever — which is backed by Silicon Valley tech billionaires — that wants to build a new city of up to 400,000 people from scratch on scrubby grasslands just east of city limits. A construction site is visible from Almond Gardens, a neighborhood with affordable housing, in Suisun City, CA on August 11, 2026. Katrina Garcia, who is running for a seat on the City Council in Suisun City, said she had received numerous calls in recent days from residents concerned the cyberattack might be linked to California Forever, because it otherwise made no sense for the cash-strapped city to be targeted.“We are a small little city,” she said. “How would it benefit a cyberattacker? You can hit New York — that’s a big deal. But a 4-square-mile city? How does it benefit them?“Suisun City officials are considering a controversial plan to expand the city’s boundaries by annexing more than 22,000 acres of land owned by California Forever — a proposal that would allow the company to sidestep restrictions for development on unincorporated Solano County land. Plans for the new city were long shrouded in secrecy. About eight years ago, a California Forever subsidiary called Flannery Associates started buying up farmland, eventually spending about $950 million on some 70,000 acres, the New York Times reported. The company for years routinely refused to answer questions about its investors, who were later revealed to be titans of the tech industry — including LinkedIn co-founder Reid Hoffman, venture capitalist and Netscape co-founder Marc Andreessen, and siblings Patrick and John Collison, who founded the payment-processing company Stripe — all led by former Goldman Sachs trader and real estate developer Jan Sramek.Because so much of the land is near Travis Air Force Base, some residents and elected officials speculated that Flannery Associates — before its backers became known — was a front for foreign investors who wanted to spy on the military facility. Prebula, the city manager, said he was well aware of speculation that the cyberattack was somehow connected to California Forever. There is, he said, “nothing that we’ve seen or come across that links it” to the company or its proposals. Julia Blystone, a spokeswoman for California Forever, said in an email that the company had no connection to the response to the breach. People fish downtown, across from Suisun City Hall. Garcia said that before the attack, residents were already alarmed by a May news release from the city manager of neighboring Rio Vista, who warned that the project and potential annexation could open the door to a giant data center being built. Suisun City officials and California Forever have said data centers are not part of the plan. “There’s been a lot of debate — a lot of, ‘What’s really going on?’ — and now all of a sudden we get a cyberattack,” Garcia said. “These things keep happening that are national news, and we’re just this little city. It’s definitely creating suspicion.”Times staff writer Stephen Battaglio contributed to this report.
