RANCHO MURIETA, CA (MPG) - A Greenfield Communications outage on the company's fiber-optic network left much of Rancho Murieta without internet, television and phone service for more than two days – from July 12 through July 14 – disrupting homes, businesses and government operations. Although service was restored to most customers by July 14, some continued experiencing internet location problems that affected streaming services and remote work.

What Happened

Greenfield attributed the outage to a large-scale distributed denial-of-service (DDoS) attack affecting its network and other providers’ networks. A DDoS attack is a cyberattack in which compromised computers or internet-connected devices flood a server or network with traffic, making it slow or unavailable to legitimate users.

On July 16, the company released a detailed explanation describing the cyberattack, restoration efforts and steps being taken to strengthen its network.

According to Greenfield, the cyberattack disrupted portions of its network infrastructure serving Rancho Murieta and other communities. Engineers first isolated the affected portions of the network, implemented temporary workarounds and verified system stability before restoring service. Customers were brought back online in phases, and some experienced additional Internet Protocol (IP) issues as network changes continued.

On July 17, Greenfield said its main network was stable but acknowledged that incorrect geolocation information continued to affect some streaming services and other internet applications. The company said it was continuing to work with streaming providers to resolve the remaining issues.

Greenfield also acknowledged customer frustration over the limited information released during the outage, saying it intentionally restricted public updates while the cyberattack was underway to avoid compromising its response or revealing information that could aid those responsible.

President and CEO Mike Powers later acknowledged the company should have communicated with customers sooner when he answered additional questions from the River Valley Times about the outage, Greenfield’s response, and changes being made following the cyberattack. (See related Q&A.)

The company also said it has implemented changes to strengthen network resiliency and is accelerating additional improvements intended to lessen the impact of future attacks.

Community Impact

As the July 12 outage continued into July 13, neighborhood social media pages filled with posts from Rancho Murieta residents seeking information, sharing updates, discussing gate access, and exchanging tips on using cellphone hotspots or other internet providers. Many residents relied on one another for information as frustration grew over Greenfield’s limited public updates. Some also reported slower-than-normal cellular data as heavy hotspot use appeared to overload nearby wireless networks.

Although internet service was restored for most customers on July 14, problems did not end there. On July 15, some residents reported that their new IP addresses appeared to originate outside the Sacramento area – or even outside the United States – causing streaming services to display incorrect local channels or block access altogether. Others said their employers’ security systems would not allow them to work remotely because their internet connections appeared to originate in Canada or other locations. The continuing issues prompted renewed criticism of Greenfield’s communications and led some residents to explore switching to other internet providers.

On July 17, Greenfield announced it would automatically apply a two-week internet service credit to customers’ next bills. Customers do not need to take any action to receive the credit.

Gates, CSD Operations

The outage also affected operations at the Rancho Murieta Community Services District.

Office phones were disabled because the district’s telephone system operates over the internet, preventing staff from answering calls. Nor could they process utility payments. Employees instead relied on cellphone hotspots to access email and shared network files. The outage did not affect the district’s water or wastewater treatment plants, Interim General Manager Amelia Wilder said.

Security Sgt. Brandon Arino said gate operations were minimally affected because the disruption was an internet outage rather than a power outage. With electrical service uninterrupted, all mechanical gates continued operating normally, and none were left open. Residents with active vehicle barcodes continued entering through the resident lanes as usual.

Arino said the primary impact was the loss of connectivity to the ABDI visitor management system, which prevented gate officers from electronically verifying visitor information. Officers implemented contingency procedures by manually recording visitor information on paper until service was restored.

When the outage disabled the gate phone system, residents couldn’t call in guests or reach the South Gate number, which also serves as an emergency contact for residents.

“From an operational standpoint, security services continued without interruption,” Arino said. “No notable security incidents occurred or were brought to my attention during the outage.”

The outage also underscored the district’s plans to install a wireless failover system already under development. Wilder said the backup connection would automatically switch the Administration Building to an alternate internet service if Greenfield’s network fails, keeping gate operations, phones and other internet-dependent services functioning. She said the system will be implemented as soon as possible.

Country Club

The Rancho Murieta Country Club experienced relatively limited disruption because the outage began Sunday afternoon, when business is slower, and the club is closed Mondays, Head Golf Professional Brian Little said. Staff installed cellular hotspots on July 14, allowing credit card and point-of-sale systems to continue running until Greenfield service was restored later that day.

The biggest inconvenience was the loss of phone service, which complicated tee-time reservations, though members could book in person or by calling Little’s cell phone. Little said the outage ultimately proved good for business, drawing more members out to play and practice. He said people wanted “to get out of the house.”

The River Valley Times also sought comment from the Rancho Murieta Association regarding the outage’s effect on association operations and whether it is considering a backup internet connection. The association did not respond before publication.

Communications Timeline

Greenfield’s public communications evolved as the outage continued. Shortly after service was disrupted just after noon on July 12, the company’s recorded message acknowledged internet service issues affecting Sacramento and Rancho Murieta but provided no information about the cause or when service might be restored.

As the outage continued into July 13, Rancho Murieta residents increasingly turned to neighborhood social media pages for information, sharing updates, reporting service conditions and posting messages they said they had received from Greenfield representatives. One such message attributed the outage to a DDoS attack targeting AT&T Internet Protocol (IP) blocks used by Greenfield to serve the community. That explanation never appeared in an official company-wide communication.

Greenfield’s first customer-wide email, sent at 5:13 p.m. July 13, stated that its network, along with those of several other providers, was experiencing a large-scale DDoS attack but made no mention of AT&T. Subsequent updates addressed the IP issues that followed restoration, explained the cyberattack and recovery effort, apologized for the limited communication during the outage and announced an automatic two-week internet service credit for affected subscribers.

An AT&T spokesman later told the River Valley Times the company had not experienced a disruption to its infrastructure, leaving unanswered questions about whether the attack targeted Greenfield, an upstream provider, or both.

CEO Responds

Greenfield President and CEO Mike Powers initially responded to the River Valley Times’ inquiry by providing the company’s July 16 statement to customers. The newspaper later submitted additional questions about the cyberattack, Greenfield’s response, customer communications, the restoration process and steps being taken to reduce the impact of future outages. Powers responded on July 17 in a detailed written reply. His answers appear in the related Q&A.