Suisun City’s mayor and City Council convened for a last-minute meeting Tuesday to discuss options after declaring a state of emergency following a cyberattack that has suspended a number of in-person city services since Friday.

The meeting included a closed session to discuss the threat and demands from the “person or persons” behind the attack, which was detected as malware by the city’s cybersecurity system shortly before 6 a.m. Friday, triggering a shutdown of much of the city’s online operations and prompted officials to close City Hall to the public.

“One thing that we ask is more patience from members of the community,” said Suisun City Mayor Alma Hernandez after Tuesday’s meeting.

The meeting was in-person only, as the city’s broadcast systems were shut down. Following the closed session, City Hall locked its doors, likely for the remainder of the week.

“Things that would normally take maybe 20 minutes might take an hour, as staff has to go through more of an analog way to do report writing or get information,” said Hernandez.

City officials could not comment on details about the cyberattack due to an ongoing investigation that includes the FBI, U.S. Department of Homeland Security, the Suisun City Police Department and cybersecurity personnel. It is unclear how long the malware was in the system before being flagged.

“I’m learning through this process how many cities, how many water systems, how many sewer systems are having these types of incidents across the country,” said Hernandez.

“It really calls for us to look at the bigger picture,” she said. “It’s an entire network of people who are doing these to public agencies across the country.”

Hernandez noted that while investigators are determining whether personal data was breached, individual homes and systems outside of the city’s networks are not currently at risk.

For now, residents are unable to have in-person meetings with city departments or drop off payment for water bills in person but can drop bills in a deposit box in front of City Hall and can pay their bills online, as the system for billing is separate from the city’s, according to Hernandez.

Calls to 911 will continue to be routed through Solano County’s system, but Suisun City police and fire departments are actively responding to reports.

City was preparing for cyberattacks

Hernandez noted that the cyberattack came right before the city brought on additional cybersecurity, which, according to City Council files, would be provided by third-party contractor Apex Technology Management. According to a July council meeting, the additional services include a backup and recovery appliance, which typically helps cities get back to business as usual soon after a malware attack.

Almost exactly one year ago, Suisun City took steps to prepare for an attack like this, contracting with Apex for $14,090 each month, according to a resolution to approve the contract in a City Council meeting on Aug. 19, 2025. In a presentation at the meeting, Apex noted its “advanced cybersecurity” services for city governments.

The contract, which went into effect immediately following the City Council’s approval, includes around-the-clock “monitoring and support services” and “disaster recovery services.”

Just two people manned the city’s information technology department prior to the contract, City Manager Bret Prebula said at the August 2025 meeting, noting that most of the burden fell on Suisun City’s IT Director, Rowland Roberts.

“Cities like ours are increasingly targeted,” said Roberts at that meeting, urging the City Council to approve the contract with Apex, which is also contracted with nearby Dixon, Rio Vista and Benicia, according to a company representative speaking at last year’s meeting.

“Without a formal security operations center, we face unnecessary risk,” said Roberts.