Desk live·
ForensicPost
Nation-state/Public sector/File 26-0131

Emergency Dispatch Survived Both Municipal Ransomware Incidents This Quarter

In both municipal ransomware incidents this desk filed this quarter, emergency dispatch survived. That outcome was determined long before the attack, by architecture choices nobody was thanked for.

Constructed geometry · not a chart of case data
TargetMunicipal emergency systems
ActorMultiple
D. Kennedy12 min readConfidence: medium2 sources reviewed

Foster City lost nearly every non-emergency service and kept 911 and police dispatch, per 26-0310. New Britain lost network systems for over 48 hours and maintained emergency response through manual continuity, per 26-0126.

Two incidents, two municipalities, same outcome on the thing that matters most. That is not coincidence and it is not luck.

Life-Safety Separation Is A Specific Architecture

Emergency dispatch surviving a ransomware event moving through a corporate network means the two are genuinely separated: different network segments, different authentication, frequently different physical infrastructure and support arrangements.

That separation is maintained at continuous cost. It duplicates work, complicates support, and produces daily friction for staff who need access to both. Its entire value is realised on days like these.

The Budget Argument Runs The Wrong Way

This is the structural problem with resilience spending, and it is worse in public bodies than in companies. The cost is annual, visible and questioned in every budget cycle. The benefit is a disaster that did not happen, which cannot be evidenced.

It is the same argument this desk filed for water utility isolation planning at 26-0728 and for manual continuity in logistics at 26-0627. Every one of those capabilities is under sustained pressure from efficiency programmes that are individually reasonable.

What Is Worth Measuring

A municipality can answer two questions cheaply. Which systems must keep working if everything else stops, and could we demonstrate today that they would?

The second question is the one that decays. Separation configured five years ago and never tested since is an assumption, and both these incidents worked because somebody had kept it real.

How we reported this

This is an analysis file built on reporting of the incidents cited, listed below. The architectural inferences are ours, drawn from reported outcomes rather than from disclosed network design. Corrections: corrections@forensicpost.com.

Sources
  1. Cyber attack continues to paralyze Foster City, Calif.GovTech
  2. U.S. state and local government under ransomware: 2025–2026 trend analysisSOCRadar
D. Kennedy
Identity and access reporter. Former DFIR consultant. Signal on request.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary