Foster City Ransomware Attack Disrupts Non-Emergency Municipal Operations

A Foster City ransomware attack compelled local government officials to temporarily disconnect public services outside of emergency responses to contain the infection, triggering an immediate and severe disruption of city services. IT administrators of the California city detected the network intrusion on March 19.

The Foster City cyberattack announcement said that the intrusion might have exposed public records. The incident crippled routine administrative functions and resulted in the cancellation of civic proceedings, but critical infrastructure remained secure.

Emergency communication protocols, specifically 911 services and police dispatch, operate on isolated networks and remain fully functional.

However, standard business telephone lines for the Foster City Police Department experienced temporary outages, forcing a reliance on alternate communication channels and manual operational workarounds.

Although investigators have not yet identified the specific ransomware variant or the responsible threat actor, city officials initiated an emergency declaration protocol.

The city has deployed external digital forensics and incident response specialists to audit the compromised network topology. To mitigate the risk of secondary exploitation, authorities advise individuals who have interacted with the municipality digitally to update their credential configurations immediately.

Ransomware actors frequently target local governments. In February, a Cocoa City disruption was allegedly linked to INC Ransom, and a New Britain City Hall network disruption took systems offline one month earlier.