Cyberattacks Disrupt Local Government Services Across Five States as Municipalities Shift to Emergency Operations

Washington, D.C. — August 11, 2026 — Local governments in California, Oklahoma, South Dakota, Texas and Wisconsin are responding to cyber incidents that have disrupted public services, disabled communications and forced municipal networks offline.

The incidents affected Suisun City, California; Coweta, Oklahoma; Mitchell, South Dakota; Coryell County, Texas; and Washburn County, Wisconsin. The disruptions varied in severity and have not been connected to a common threat actor or coordinated campaign.

Coweta has identified its incident as a ransomware attack. Suisun City reported that malicious software compromised its systems. The other affected governments have described cyber incidents, attacks or technology disruptions without publicly attributing them to ransomware.

Authorities have not identified the actors responsible, disclosed initial-access methods or stated whether stolen information was removed from any of the affected networks.

Suisun City experienced the most serious public-safety disruption when malicious software compromised municipal information-technology systems on August 7.

The attack affected 911 routing, police and fire dispatch, government records and other city services. Officials shut down the entire municipal network to contain the intrusion and prevent additional systems from being affected.

Emergency services remained available after public-safety calls were rerouted through the county dispatch center. The temporary arrangement allowed police, fire and emergency personnel to continue receiving calls while the city’s normal systems remained unavailable.

Suisun City contacted federal and state authorities for assistance. The FBI is investigating the incident and supporting efforts to maintain essential government operations.

The City Council held a special meeting on August 8 and declared a state of emergency. The declaration allows the city to access emergency resources and funding required for containment, investigation, restoration and recovery.

City Hall was closed for in-person business on August 10, and nearly all municipal departments remained closed to the public. Officials have not announced when normal operations will resume.

Suisun City, located in the San Francisco Bay Area and home to approximately 30,000 residents, has not identified the malicious software, disclosed whether a ransom was demanded or stated whether personal information was accessed.

The city also has not announced whether the attackers maintained access to the network before the disruption was detected. The investigation must determine how the attackers entered, which accounts or systems were compromised and whether the incident extended beyond the services already identified.

Coweta reported a ransomware attack on August 5 that affected municipal computers, files and digital services.

The Oklahoma city shut down affected technology while cybersecurity specialists worked to remove the ransomware, examine the environment and restore government records through off-site backups.

Police and fire departments relied upon separate off-site systems that were not affected. Coweta’s public website remained available, and its online bill-payment service continued operating because an outside provider maintains that platform.

City Hall could not accept credit or debit card payments for utility accounts in person. Officials pledged that water service would not be disconnected for nonpayment while municipal payment systems remained unavailable.

Coweta, which has approximately 12,000 residents, reported the attack to federal and state authorities. The city has not disclosed the ransomware strain, amount of any demand or whether officials communicated with the attackers.

The availability of off-site backups gives Coweta a path toward restoring files without relying solely upon systems affected by the attack. Those backups still require validation before being returned to production because restoration cannot begin safely until compromised systems have been isolated and cleared.

Backup recovery also does not determine whether attackers accessed or removed information before encryption. That question requires a separate examination of authentication records, network activity, administrative accounts and affected devices.

Mitchell shut down government networks on August 7 while officials investigated a cybersecurity incident.

Emergency services were not affected by the shutdown. Officials have not identified the compromised systems, disclosed whether municipal information was accessed or announced when the network will return to normal operation.

Mitchell has not publicly classified the incident as ransomware or attributed it to a specific threat actor. Keeping the network offline during the investigation limits further access and gives specialists an opportunity to determine which systems can be restored safely.

Coryell County also disclosed a technology disruption affecting government operations in Texas. Public information concerning the incident remains limited.

The county has not publicly identified the cause, classified the disruption as ransomware or disclosed which systems were affected. No connection has been established between the Coryell County disruption and the incidents affecting the other municipalities.

Washburn County shut down its network after identifying a cyber incident on August 6.

County employees and members of the public experienced interruptions involving services dependent upon internet access and county telephone systems. The network remained offline while specialists worked to identify the cause and assess the affected environment.

Washburn County Board Chair Lolita Olson said residents could experience temporary disruptions involving county services and telephone communications during the response.

The county directed calls through 911 so dispatchers could route them to the appropriate department while ordinary telephone service remained unavailable.

The Washburn County court system reported that its telephone and fax lines were still down on August 10. Scheduled court hearings continued, and the electronic filing system remained operational.

The continued availability of court hearings and electronic filing demonstrates that some essential functions were separated from the county systems affected by the incident. Telephone and fax outages still create difficulties for court personnel, attorneys and residents attempting to obtain information or communicate with court offices.

None of the five governments has announced that emergency response was entirely unavailable. Suisun City experienced a disruption to its normal 911 and dispatch infrastructure but continued operations by routing calls through the county. Coweta’s police and fire systems remained protected through off-site services, and Mitchell reported that emergency services were unaffected.

The incidents demonstrate how attacks against municipal networks can affect services beyond office computers. Local governments operate emergency communications, utility billing, courts, public records, permitting, payroll and administrative systems that residents depend upon daily.

Taking a network offline can prevent an attacker from moving farther into the environment, but it can also suspend services until investigators determine that restored systems are free from unauthorized access.

Recovery requires more than reconnecting computers. Affected governments must identify the original access point, remove malicious software, reset compromised credentials, inspect administrative accounts, validate backups and monitor restored systems for renewed activity.

Officials must also determine whether protected information was accessed or removed. That assessment may affect legal notification requirements and the assistance offered to residents, employees or other individuals whose information was exposed.

The simultaneous disruptions across five states do not establish that the attacks are related. Local governments are frequent targets because they maintain valuable information, operate essential services and may depend upon aging technology with limited cybersecurity staffing.

Each incident remains under investigation. The affected governments are continuing containment and restoration work while federal, state, local and private-sector specialists examine the compromised environments.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---