Suspicious Activity on a Friday

The City of St. Paul, Minnesota's capital and home to more than 311,000 residents, first detected suspicious activity on its networks on July 25, 2025, a Friday. City cybersecurity staff traced the initial point of entry to a shared Parks and Recreation network drive, which the attackers appear to have used as a foothold before moving deeper into municipal systems. Within days, it became clear the city was dealing with a full-scale ransomware intrusion, later attributed to the Interlock ransomware group, a relatively newer extortion gang that had already claimed a string of attacks against local governments, healthcare providers, and other organizations in North America.

The response escalated quickly. On July 26, the city brought in a national cybersecurity vendor to assist with containment and investigation. On July 27, VPN access was restricted to cut off potential remote pathways for the attackers. By July 28, city officials made the decision to shut down the entire network — an aggressive but often necessary step to stop a ransomware operator from further encrypting systems or exfiltrating additional data.

A City Paralyzed

The disruption rippled across day-to-day civic life. Online payment portals went dark, meaning residents could not pay utility bills or fines through the city's website. Public Wi-Fi access was cut. Library systems and recreation center operations were disrupted. While the city emphasized that emergency services such as police and fire dispatch continued operating without interruption, the broader breakdown of administrative and public-facing systems was significant enough that Mayor Melvin Carter declared a state of local emergency.

That declaration cleared the way for an unprecedented escalation: on July 29, 2025, Minnesota Governor Tim Walz activated the state National Guard's 177th Cyber Protection Team to assist with incident response. It marked the first time in the unit's eight-year existence that it had been deployed within Minnesota itself, reflecting both the severity of the attack and the recognition that a mid-sized city's internal IT and security staff could not handle a ransomware incident of this scale alone.

Attackers, Data Theft, and a Ransom Refusal

Interlock is believed to have exfiltrated approximately 43 gigabytes of data from St. Paul's systems before city defenders were able to isolate affected servers. Rather than pay the ransom demanded by the group, city leadership — with Mayor Carter's public backing — refused to negotiate, a decision consistent with guidance from federal law enforcement agencies that generally discourage ransom payments to avoid funding future criminal operations and because payment offers no guarantee that stolen data will actually be deleted.

Interlock followed through on its threat. On August 11, 2025, the group published a portion of the stolen data on its dark web leak site after the city declined to pay. Working with an outside forensic and data-review vendor, the city subsequently identified the scope of individuals affected. Ultimately, the exposed data set was found to include sensitive personal information — names, addresses, phone numbers, dates of birth, and Social Security numbers — tied to 12,484 residents and city employees. St. Paul began formal notification of those affected once the review was complete, as required under state and federal breach-notification obligations.

Recovery: Weeks, Then Months

The recovery process unfolded over an extended period. Core services such as online payment systems, library operations, and data storage were largely restored by around the third week of August 2025, roughly a month after the initial detection. However, city officials and outside reviewers characterized full recovery — including hardening systems, rebuilding trust in affected applications, and completing forensic work — as a process that stretched over several months beyond that point.

The Minnesota National Guard's cyber team concluded its assistance to the city in mid-August 2025, after providing what officials described as critical support during the most intensive phase of the response. The broader recovery effort drew on a coalition that included Minnesota IT Services (the state's central IT agency), federal and state law enforcement investigators, private-sector incident response specialists, and the National Guard unit — an illustration of how thinly resourced municipal governments increasingly rely on state and federal partners when facing sophisticated ransomware operators.

Fallout and Lessons for Municipal Governments

The St. Paul incident became a widely cited case study for local government cybersecurity, both because of its scale and because of the unusual step of activating military cyber resources for a domestic municipal response. Coverage from GovTech and other outlets highlighted several takeaways that other cities have since referenced in their own preparedness planning:

• The value of having pre-established relationships with state emergency management and National Guard cyber units before an incident occurs, rather than negotiating access during a crisis
• The importance of network segmentation, since the attackers' initial foothold in a single departmental file share (Parks and Recreation) was ultimately able to threaten citywide systems
• The benefit of a clear, publicly communicated ransom-payment policy, which gave city leadership a consistent position to point to under pressure
• The need for realistic recovery timelines in emergency planning — restoring visible services took weeks, but complete technical remediation took considerably longer
• The role of transparent, staged public communication, with the city maintaining a dedicated "Cyber Incident Info Hub" to keep residents updated as facts were confirmed

St. Paul's experience has since been referenced by federal and state cybersecurity officials as an example of both the disruptive potential of ransomware against local governments with limited security budgets, and of a relatively well-coordinated multi-agency response once the crisis was underway.