Ransomware Attack on Minnesota Capital City
On July 25th, Minnesota’s capital, St. Paul, fell victim to a major cyber attack. City officials moved quickly to contain the breach, ultimately shutting down their networks on July 28th to prevent more damage. Mayor Melvin Carter declared a state of local emergency, and on July 29th, Governor Tim Walz activated the Minnesota National Guard’s 177th Cyber Protection Team to assist with the situation recovery.[1] It was a historic moment, as the unit had never been deployed within the state before in its eight years of existence. The National Guard stayed on duty in St. Paul until August 17th, working side by side with city staff and federal investigators.[2]
Carter described the cybercriminals responsible for the attack as a “sophisticated” and “money-driven” ransomware group. The attackers, identified as the group Interlock, demanded payment to restore systems and keep stolen data private. Following guidance from the FBI and National Guard, city leaders refused their demands. In response, the hackers posted about 43 gigabytes of stolen city data online. Carter later explained that most of the compromised files originated from a shared drive in the city’s Parks and Recreation Department. The contents varied widely, from work documents and ID copies to personal odds and ends like recipes. Although substantial, the leaked data was only a tiny part of the 153 terabytes the city maintains.[1, 3]
Meanwhile, the service disruption caused by the attack has led many city operations to shift into what Carter calls “manualizing.” In libraries, for example, staff have gone back to using physical checkout cards to track borrowed items.[4] The city has been giving regular updates on its recovery process through its official channels.[5] To prevent future breaches, St. Paul has started investing in training and simulations. City employees now participate in phishing drills and tabletop exercises, which are modern “war games” designed to prepare them for real-world cyberattacks. “Over 3,500 St. Paul city employees now have absolutely the longest passwords of their entire lives,” Carter remarked.[4]
The mayor adds that St. Paul is not alone. At least half a dozen Minnesota cities, including nearby North St. Paul, have already experienced cyber incidents in 2025.[4] The St. Paul attack has spurred a broader push for “whole-of-state cybersecurity”: a philosophy focused on cooperation among cities, counties, state agencies, and federal partners. Officials believe that by uniting within this framework, governments can better defend themselves against increasingly aggressive cyber threats adversaries.[2]
References:
[1] Government Technology. St. Paul, Minn., Systems Come Back Online After Cyber Attack. 2025.
[2] Government Technology. St. Paul Cyber Attack Sparks Reflections, Calls to Action. 2025.
[5] St. Paul Government. Important Information on City Services During Digital Security Incident. 2025.