Asked whether Suisun City would pay a ransom to the people who crippled its computer network, Mayor Alma Hernandez did not say no. "I don't have the answer for that," she told reporters at the shuttered City Hall on Monday, "and so the negotiation team is going to be navigating that."

That single non-answer is the part of the Suisun City cyberattack that should hold the Bay Area's attention. A malware intrusion that began at 5:45 a.m. on Aug. 7 knocked out 911 routing, police and fire dispatch, records and online services in the 30,000-person Solano County city, forced City Hall to close, and pushed the City Council to declare a state of emergency. By the second week, the attackers had made demands the council was weighing behind closed doors — and Suisun City had become the latest small Bay Area government caught, in the words of one Berkeley computer scientist, as "easy prey."

Malicious software infected the city's IT systems at about 5:45 a.m. on Friday, Aug. 7, the city said, hitting "critical public safety operations, including 911 routing, police and fire dispatch, records and city services." The city shut its entire network down — automatically, according to officials, the moment an intruder was detected — to contain the damage and, it said, to "preserve evidence for a federal investigation." On Saturday morning the City Council convened a special meeting and declared a state of emergency, a step that lets the city tap outside support and recoup costs.

By early this week the incident had escalated from breach to negotiation. The council took up the question of how to respond to demands from the entity behind the attack, and the mayor's acknowledgment of a "negotiation team" confirmed what the shorthand "malware attack" tends to obscure: this reads like a ransomware case, the kind where criminals lock a government out of its own systems and wait to be paid.

On the ground, the disruption was mundane and total. City Hall closed Monday, with in-person service suspended across the planning, building, housing, water, finance, human resources and public works departments and the city manager's office. Residents were turned away at the door. Grace Nelson, who had come to ask about a building permit, wasn't angry. "I don't think it's their mistake, right?" she said. "It's something that's unavoidable."

Emergency response, officials stressed, kept working. Suisun City's dispatchers began fielding 911 calls routed through the Solano County sheriff's dispatch center in Fairfield. "If you call 911 and you're in Suisun City, you will get a police dispatcher, you will get fire and police services," Police Chief Aaron Roth said — while accepting FedEx packages by hand at City Hall. "It's definitely disrupted how we'd normally do things."

What makes Suisun City less an anomaly than a data point is how familiar the script has become. "Cybersecurity attacks on small cities are common," said David Wagner, a computer science professor at UC Berkeley. "Criminals see them as easy prey." His colleague Chris Hoofnagle, faculty director at the Berkeley Center for Law & Technology, described the underlying leverage bluntly: cripple a city's ability to collect taxes and fees, and "it's quite coercive that cities might end up paying a ransom to unlock their systems."

The regional ledger backs them up. Foster City declared its own state of emergency after a March ransomware attack that knocked out services for more than a week. Pittsburg lost nearly $1 million to a February phishing scam, recovering about half. Oakland's 2023 ransomware siege disabled, among much else, the city's ability to charge for parking.

Suisun City is working with the FBI, the Department of Homeland Security and the California Office of Emergency Services to investigate and rebuild; the FBI's Sacramento office would neither confirm nor deny involvement. Officials have offered no timeline for restoring systems, and no public accounting of what — if anything — the negotiation team is prepared to pay. "I ask for patience at this time," Hernandez said. "We're going to work as expeditiously as we can."