Cyberattacks on Emergency Communications

August is National Emergency Management Awareness Month. Emergency managers work year-round, 24/7/365, to reduce risk, strengthen resilience, and help people, businesses, and institutions prepare for and respond to major disruptive events. This month my team is proudly supporting National Emergency Management Awareness Month by highlighting key aspects of the profession and why they matter.

First up, an analysis of why we, not only as Emergency Management professionals, but also as ordinary citizens, should care about cybersecurity when it comes to Emergency Communications. At the end of the article you’ll find tangible, actionable steps Emergency Communications professionals can take to reduce risk before the next attack.

Cyberattacks on Emergency Communications: A Growing Threat to Public Safety

Emergency communications centers are among the most important parts of the public safety system. When someone calls 911, reports a fire, requests medical help, or needs police assistance, these centers serve as the link between the public and first responders. They rely on many connected technologies, including Computer-Aided Dispatch (CAD) systems, emergency call handling systems, public safety radio networks, and mass notification platforms. These tools help dispatchers collect information, assign responders, share location data, and warn the public about urgent threats.

In recent years, however, emergency communications infrastructure has become a more frequent target for cybercriminals. Public safety agencies often operate with limited funding, aging technology, small information technology teams, and systems that must remain available every hour of every day. At the same time, modern emergency communications are becoming more connected through internet-based platforms and cloud services. This connectivity improves speed and coordination, but it also expands the number of possible entry points for attackers.

Cyberattacks on emergency communications centers can create consequences far beyond ordinary technology outages. When CAD systems, alert platforms, or phone lines are disrupted, dispatchers may have to work manually, neighboring agencies may need to absorb calls, and residents may lose access to timely warnings. These incidents show that cybersecurity is no longer only an administrative concern for public safety agencies. It is now a core part of emergency readiness, community resilience, and life safety.

Why Emergency Communications Systems Are Attractive Targets

Emergency communications centers, also known as public safety answering points or PSAPs, are especially attractive to threat actors because they perform essential services under intense time pressure. A successful attack can interrupt emergency operations, create public concern, and place pressure on local governments to restore service quickly. Cybercriminals understand that agencies responsible for emergency response cannot simply shut down operations while systems are repaired.

The systems at risk include more than the phone line used to receive a 911 call. CAD systems help dispatchers enter call details, recommend response units, record times, and transmit information to police, fire, and emergency medical services. Mass notification systems allow local governments to warn residents about evacuations, severe weather, hazardous materials incidents, missing persons, and other urgent conditions. Public safety radio systems keep first responders connected in the field. If any of these systems are disabled, the entire emergency response chain can slow down.

Recent Incidents Show the Scale of the Problem

Recent cybersecurity incidents illustrate how disruptive these attacks can be. In April 2026, the Patriot Regional Emergency Communications Center in Massachusetts, which serves communities including Pepperell and Ashby, experienced a cyberattack that affected important communications functions. Although 911 calls remained operational, non-emergency and business phone lines were knocked out. The center had to rely on outside support while recovery efforts continued. This kind of incident demonstrates that even when the most critical emergency line remains available, surrounding systems can still be impaired in ways that complicate public safety operations.

Another major example involved the CodeRED emergency notification platform operated by Crisis24. In late 2025, a cyberattack damaged the legacy OnSolve CodeRED environment, leading the company to decommission that platform and transition customers to a newer system. The disruption affected agencies that used CodeRED to send local alerts by phone, text message, and email. Reports also indicated that subscriber information such as names, addresses, phone numbers, email addresses, and passwords may have been exposed. The incident showed that emergency notification tools are not only operational assets; they also contain sensitive public data that must be protected.

Disruptions to CAD systems can be especially difficult. When dispatch software is unavailable, telecommunicators may have to take notes by hand, track units manually, or relay information through backup channels. These workarounds can keep basic operations moving, but they increase the risk of delays, duplicate work, and incomplete information. Public safety threat reporting has found that some dispatch-system disruptions can last for days or even weeks, forcing agencies to operate in degraded conditions for extended periods.

Operational and Community Consequences

The consequences of cyberattacks on emergency communications are both technical and human. Technically, an attack may disable servers, encrypt files, expose data, disrupt authentication systems, or block access to dispatch tools. Operationally, the attack can force agencies to activate continuity plans, reroute calls, use neighboring jurisdictions for backup, or return to manual processes. For the public, the most serious concern is whether help will arrive quickly and whether warnings will reach residents before danger escalates.

These incidents can also damage community trust. Residents expect emergency services to be available at all times, and they may not understand the difference between a complete 911 outage, a non-emergency line outage, a CAD outage, or a notification-platform failure. Clear public communication is therefore essential during and after an incident. Agencies must explain what services remain available, what temporary procedures are in place, and how residents should seek help or receive alerts until normal operations are restored.

Federal Guidance and the Move Toward Resilience

Federal agencies have recognized the seriousness of these risks. The Cybersecurity and Infrastructure Security Agency (CISA) provides resources for public safety communications organizations, including guidance on reporting cyber incidents, improving resilience, preparing for ransomware, and understanding what to expect during the first 48 hours after an incident. CISA also supports the transition to Next Generation 911, or NG911, which is designed to improve interoperability, support multimedia communications, and strengthen the resilience of emergency communications networks.

The Federal Communications Commission (FCC) also plays a major role in 911 reliability. Communications providers have obligations related to 911 call completion, outage reporting, notification to public safety officials, and network reliability. These requirements are intended to ensure that outages are quickly identified, that affected emergency communications centers receive timely information, and that broader trends can be monitored. As emergency communications become more dependent on internet-based systems, reliability and cybersecurity responsibilities are increasingly connected.

Reducing Risk Before the Next Attack – What can be done?

Reducing the risk of cyber disruption requires preparation before an attack occurs. Emergency communications centers should:

• Conduct cyber risk assessments
• Identify their most critical systems
• Understand how long they can operate if those systems fail
• Maintain tested backup procedures for call taking, dispatching, radio communications, public alerting, and data recovery.

A backup plan is only useful if staff know how to use it under pressure, therefore regular exercises and tabletop drills are important parts of preparedness.

In addition, basic cybersecurity practices remain essential. Agencies should:

• Use strong authentication
• Regularly update software
• Protect remote access
• Segment critical networks
• Monitor for suspicious activity
• Keep secure backups that are separated from production systems.

Because many attacks begin with phishing or stolen credentials, ongoing employee training is also important. Dispatchers, supervisors, information technology staff, and leadership all have a role in recognizing threats and reporting unusual activity quickly.

Conclusion

Cyberattacks on emergency communications systems are a serious and growing threat to public safety. The incidents involving dispatch centers, CAD systems, and emergency notification platforms show that attackers can disrupt more than data networks; they can interfere with the systems communities depend on during their most urgent moments. As public safety agencies modernize through NG911 and other connected technologies, cybersecurity must be treated as a fundamental part of emergency operations. Protecting these systems requires investment, planning, training, coordination, and a commitment to resilience. When emergency communications remain secure and reliable, first responders can act faster, residents can receive timely warnings, and communities are better prepared to face both physical and digital emergencies.

Arcova helps organizations strengthen resilience against cyber threats by combining cybersecurity, emergency management, and continuity planning expertise. Our team works with organizations to assess cyber risks, identify critical system dependencies, develop continuity of operations strategies, conduct exercises and tabletop simulations, and strengthen incident response capabilities.

By integrating cybersecurity into broader emergency preparedness and resilience programs, Arcova helps organizations reduce operational disruption, protect critical communications systems, and maintain essential services when cyber incidents occur.