SAN FRANCISCO (KGO) — A ransomware attack on Foster City has suspended city government services and prompted a local state of emergency as thousands of cybersecurity professionals gather in San Francisco to address the growing global threat.
The attack comes as more than 40,000 people attend the RSAC Conference at Moscone Center, one of the world’s largest cybersecurity events, where experts are discussing ransomware and other digital threats affecting governments and businesses.
RELATED: Foster City declares emergency after cyberattack forces city computer system offline for days
Cybersecurity companies at the conference say ransomware remains a serious and growing problem. Chris DiRado of Commvault said his company focuses on helping victims recover.
“We help customers bounce back from ransomware attacks. As you know, ransomware is really threatening our industry here. It’s going to be a $12 trillion industry alone,” DiRado said.
The conference has drawn thousands of cybersecurity professionals, many of whom specialize in preventing and responding to ransomware attacks.
“If you look around at RSAC, there are 40-thousand ‘defenders’ who are here who made it their careers and mission to stop it from happening,” said Conor Sherman, chief information security officer of Sysdig.
MORE: 2 Contra Costa Co. cities still recovering after being hit by cyberattacks
Jonathan Trull, chief information security officer of Qualis, which is based in Foster City, said he has extensive experience responding to ransomware incidents.
“I ran the incidence response team for Microsoft for five years. We responded to over 300 ransomware attacks a year,” Trull said.
A recent cyberattack on Foster City crippled computer systems and halted government services, highlighting what experts say is a growing trend of attacks targeting cities and local governments.
“Municipalities are underfunded at times. They are part of critical infrastructure, but they don’t always have the talent and the money to defend against such sophisticated attacks,” Trull said.
Recovering from such attacks requires preparation, including reliable data backups, he added.
MORE: City of Hayward declares local emergency after ransomware attack
“I think you need to run a standard playbook to recover. You need a good backup so you can restore data. Sometimes it’s just forgotten,” Trull said.
The attack prompted Foster City officials to declare a state of emergency, allowing the City Council to approve a resolution that provides access to additional resources to keep systems operating.
Experts at RSAC say ransomware attacks are becoming more frequent and more damaging worldwide.
“We get institutions and companies and municipalities are attacked in Iceland as well,” said Hallgrimur Bjornsson, CEO of Varist.
Bjornsson said the conference offers critical education on emerging cyber threats and responses.
“Nobody is safe,” Bjornsson said. “Many threats are from abroad. For instance, the ones from my country have been from Russia. There are no boundaries in cyber.”
While some cyberattacks can involve state actors, experts cautioned against assuming government involvement in every case.
“What you find is that sometimes they are state sponsored but most of the times, they are economically motivated,” Sherman said.
“All indications are this is a pay scheme for some threat actors to get rich,” Trull added.
Foster City officials say most city computer systems remain offline as they work with cybersecurity specialists during the investigation. The RSAC Conference at Moscone Center concludes Thursday.
Copyright © 2026 KGO-TV. All Rights Reserved.
