California City Emergency & CSS Bomb Email Attacks Threaten Businesses

by The Creator | Aug 9, 2026

Email attack response starts with immediate isolation of compromised accounts and verification of employee credentials. The CSS bomb attack method discovered this week allows hackers to weaponize standard email code to steal passwords without traditional malware, making this a threat that standard spam filters cannot stop.

This weekend brought alarming cybersecurity news that directly impacts small business owners. Suisun City, California declared a state of emergency after a devastating cyberattack knocked out their entire computer network, including critical 911 emergency services. The FBI is currently investigating this incident, which demonstrates how quickly cyberattacks can cripple essential operations.

A new and dangerous threat has emerged for businesses: 'CSS bomb' attacks. Security researchers have discovered that hackers can weaponize ordinary email styling code to steal passwords and hijack sessions in popular webmail platforms like Outlook and Gmail, all without using traditional malware. This means your employees could be at risk simply by opening emails.

Major companies aren't immune either. Levi Strauss & Co. disclosed a social engineering cyberattack that exposed sensitive corporate data. The North Carolina Ports Authority suffered a cyberattack that disrupted IT systems and operations across multiple port facilities. These incidents show that organizations of all sizes are targets.

In a concerning development highlighting AI security risks, OpenAI has paused work on their Astra AI model after discovering it could autonomously find vulnerabilities and launch cyberattacks without any human intervention.

For small business owners, the key takeaways are clear: invest in employee training on email safety, enable multi-factor authentication across all systems, and maintain offline backups of critical data. Whether facing AI-powered threats or traditional phishing attacks, preparation and vigilance remain your strongest defenses.

How should your SMB handle an email attack threat?

CSS bomb attacks work by embedding malicious styling code in emails sent to Outlook and Gmail users. When opened, the code can steal session tokens and passwords without triggering malware alerts. For SMBs in manufacturing and professional services, this means your staff is vulnerable during normal email use. CISA and security researchers recommend three immediate actions: enable multi-factor authentication on all email accounts to block session hijacking even if passwords are stolen, provide employees with email safety training focused on suspicious sender verification, and maintain offline backups of critical files so ransomware or data theft cannot paralyze operations. The Suisun City emergency shows how quickly attacks escalate from email compromise to network shutdown.

Key takeaways

Enable multi-factor authentication on email and critical systems now, not after a breach occurs.
Train employees to verify sender identity before clicking links or downloading attachments, even from familiar accounts.
Back up critical data offline weekly so you can recover operations within hours if email compromise spreads to your network.

Frequently asked questions

What is a CSS bomb attack and why can't my spam filter stop it?

CSS bomb attacks embed malicious code in email styling that appears as normal formatting to filters. The code executes only when the email is opened in Outlook or Gmail, stealing passwords and session tokens. Standard malware scanners do not flag styling code as dangerous, which is why MFA is critical as a second layer of defense.

If an employee opens a CSS bomb email, what do I do first?

Reset that employee's email password immediately and force them to log out of all active sessions. Check your email logs for forwarding rules or unusual access from new locations. Require MFA re-enrollment and scan the employee's computer for unauthorized credential access. If your system stores cached credentials, consider forcing a full network password reset as well.

How often should we back up data offline to protect against email-based attacks?

Weekly offline backups are the minimum for SMBs. If your business relies on real-time data (manufacturing orders, client files), consider daily backups to a disconnected storage device. Test restoration quarterly to ensure backups are readable and complete.

Does multi-factor authentication really stop CSS bomb attacks?

MFA stops the attack from spreading once a password is stolen. Even if the attacker gains your employee's password, they cannot access email or systems without the second factor (phone code, hardware key, or authenticator app). This is why MFA is non-negotiable for any business handling client or operational data.