Ransomware Took Foster City Permits, Licences and Utility Billing Offline

IT staff at Foster City, California, discovered ransomware spreading across the city’s networks in early March 2026. By morning nearly every non-emergency municipal service was offline: building permits, business licences, park reservations, public records requests and utility billing. Emergency services, including 911 and police dispatch, continued operating.

Emergency dispatch surviving while permit systems did not is the single most important fact in this file. It indicates that the systems carrying life-safety functions sit on infrastructure that ransomware moving through the corporate network did not reach.

That separation is expensive to maintain and produces daily friction — separate credentials, separate support, duplicated work. It is exactly the kind of arrangement that gets questioned in budget reviews on the grounds that nothing has ever happened.

It is tempting to file a permit system outage as an inconvenience. For a construction firm with crews booked, a permit delay is payroll. For a household, a utility billing failure can mean a missed payment on a bill they cannot pay online — the pattern this desk filed at BridgePay in 26-0209.

Public records requests stopping also has a specific civic consequence: the mechanism by which residents and journalists scrutinise the city was unavailable, and there is no alternative provider.

A retailer taken offline loses customers to competitors. A city has no competitor. Residents who need a business licence cannot get one anywhere else, and the demand does not disappear during the outage — it queues and arrives all at once on restoration.

That is why municipal recovery timelines are longer than the technical restoration suggests, and why the visible impact continues well after systems come back.