Suisun City's City Hall to remain closed through the week after malware attack

A Northern California city held another emergency council meeting Tuesday, days after a malware attack disrupted public safety systems and other city operations.

Suisun City leaders met at 8 a.m. for a special session that included a closed-door portion. Officials decided that City Hall will stay closed for the rest of the week as the city deals with the issue.

"We're trying to understand exactly what happened," Mayor Alma Hernandez said. "If you're coming in to try and pay your water bill, in cash or trying to pull a permits for a building, or trying to get a business license - today those operations are down."  

It comes three days after the council unanimously declared a state of emergency in response to the attack during a special Saturday meeting. The declaration allows the city to more quickly access emergency resources and recover costs related to the cybersecurity incident.

City officials said malicious software infected its IT systems Friday morning, affecting 911 routing, police and fire dispatch, records and other city services. Suisun City shut down its entire IT network to contain the threat and preserve evidence for a federal investigation.

Hernandez said that, so far, there is no indication that people's personal information has been stolen. 

"But I do recommend to our community, as a good practice, if they use credit monitoring as an example, just to make sure that that's all good to go," Hernandez said. 

As of Monday, officials said public safety operations remain active, but some city services were still limited or closed to the public.

Police and firefighters have continued responding to calls, city officials stressed, while dispatchers were taking 911 and non-emergency calls through the Solano County dispatch center.

Suisun City officials have said they are working with the FBI, Department of Homeland Security, California Office of Emergency Services and other agencies.

Exactly how the malware entered the city's systems, and who may be responsible, has not been detailed by officials.

Vitaliy Panych is a cybersecurity expert for World Wide Technology and a former California state chief information security officer.

"How well prepared they are is what makes or breaks an organization," Panych said.

In recent years, several California cities have been hit with cyberattacks, including Modesto, Hayward, Oakland, Galt, and Lodi. Panych said that cyberattackers often look to get into networks through administrative accounts. 

"So, generally they go after where it impacts most your privileged assets, your privileged accounts, meaning administrative users that have too much access within an organization, so that's where the blast radius will be far greater," he said.

Hernandez said City Hall would be back open by next week but it may take several months for the network to be fully up and running again.