Foster City council ratifies emergency proclamation after ransomware attack

Foster City council members voted to ratify a proclamation of local emergency after staff reported a ransomware attack that impaired the city's network and interfered with services.

City legal staff told the council that "the city's net network was recently attacked by an external actor in the form of a ransomware attack, and this attack caused network access to become unavailable, significantly interfering with city staff's ability to conduct business and provide services," and recommended adoption of a resolution to ratify the City Manager's proclamation. The council heard the report and moved to place the matter on the agenda as an emergency item before taking the formal ratification vote.

The motion to adopt the resolution passed on a voice vote after the chair called for those in favor to say "aye"; the council recorded the motion as carrying. Staff said state law requires ratification within seven days of a local‑emergency proclamation.

The emergency item was added after the City Attorney advised the council that Government Code section 54954.2(b)(2) authorized adding an item that arose after agenda publication and that the incident warranted a closed‑session discussion under Government Code section 54957. After ratifying the proclamation, the council recessed into closed session to discuss the cybersecurity threat to public services and facilities.

The council did not provide detailed technical or forensic findings in open session. Staff said the proclamation stemmed from conditions discovered after the agenda was posted and that the proclamation and subsequent closed session are intended to allow the city to confer confidentially with counsel and take necessary emergency steps.

Next steps: staff will continue incident response and provide updates as appropriate; the closed session was convened to allow confidential briefing and direction to staff and counsel.