What stuck out to me was the part that said, "A similar attack affected the city’s phone system last year, shutting down automated dispatches for 911 and 311 calls." Clearly what they had didn't catch it (twice) and that's a problem with SIEMs - usually not configured correctly or to log the right things.