Foster City Declares Emergency After Ransomware Attack Cripples Municipal Network

City IT staff identified the ransomware in the early hours of Thursday, March 19, but a week later, Foster City's network remains inaccessible as the cyberattack continues under investigation. The city council voted 4-0 Monday night to declare the emergency, with the city government's computer network paralyzed by the cyberattack for a sixth day.

The council approved the state of emergency during a special meeting Monday night, with no Zoom or online access, as the network remains shut down. The irony was hard to miss: a government body convened to address a digital collapse had no digital connection to the public it serves. Mayor Art Kiesel declined to comment on camera but told CBS News Bay Area reporter Kevin Ko that he has full confidence in the city's investigation; Kiesel, along with other councilmembers, are currently advised not to speak publicly about the ransomware attack.

While the investigation is underway, the city has taken its network offline, disrupting phone and email systems and leaving city staff unable to make or receive phone calls or respond to emails. City Hall remains open to the public, but only with limited services. The Foster City Police Department and other law enforcement agencies are currently investigating the attack.

The city warned that it is possible that public information has been accessed, and said investigations are underway. Yet officials have offered little beyond that. The city is not providing details on what exactly has been compromised by the attack, but did disclose that anyone with business with Foster City should change their passwords.

That silence has unsettled residents. Yiming Luo was the only community member to address the council at Monday's special meeting. "The city has kind of been keeping us in the dark. I mean, we don't know what got affected, what departments are affected, how it affects us," he said. Luo's concern is also personal: he booked a pickleball court on the city's website and wants to know whether his credit card data was exposed. He raised a pointed financial question: "Do they have cyber insurance? Or are we taxpayers through the general fund, are we going to front all the costs to rebuild all the servers?"

James Cowan, a Foster City resident in the middle of a home renovation, is facing a more immediate bureaucratic headache. The city's permitting tracking system is frozen; for fire and medical services, Foster City has had a years-long partnership with Belmont and San Mateo that provides continuity. Cowan put it plainly: "It seems pretty opaque at this point. We don't have any sense of how significant is the damage, what they have taken, what they haven't, and what's been compromised."

With the proclamation of a local emergency, the city will now be eligible to receive expedited assistance and resources; both San Mateo County and the Governor's Office of Emergency Services have been notified. Foster City is working with independent cybersecurity experts to investigate and restore the impacted systems, though a spokesperson for the city said they don't know when they'll be able to restart Foster City's computer network.

City Manager Stefan Chatwin said he is not aware of any similar occurrence of this magnitude in the city. Ransomware attacks and cybersecurity breaches have increased significantly over the last couple of years, affecting both private sector companies and public agencies; the latter tend to be more resource-constrained, which can make them particularly vulnerable, according to Ian Lin, director of research and development at cybersecurity firm Packetlabs. Ransom demands are increasing, Lin said, up "almost 80% or 90% from 2025," with attackers demanding higher amounts.

Other communities in the Bay Area that have experienced ransomware attacks in recent years include Oakland, Hayward and St. Helena. For Foster City's 33,000 residents, the central questions, including what was taken, what it will cost, and how long services will remain paralyzed, remain unanswered.