In July, the City of St. Paul suffered a **ransomware attack** that forced a **complete shutdown of its public Wi-Fi and Internet-based systems**, including library terminals, City Hall networks, and key municipal services. The attack disrupted critical operations, prompting a **state of emergency declaration**, FBI involvement, and assistance from the Minnesota National Guard’s cybersecurity team. While no ransom was paid, hackers **leaked non-sensitive data online**, and recovery efforts took months to restore systems—including public Internet access, financial/payment platforms, telephones, email, and permitting services. The attack necessitated **network segmentation**, stricter access controls, and modern safeguards to prevent further breaches. Residents, particularly vulnerable groups relying on library and recreation center Internet for work, education, and job applications, faced prolonged disruptions. The incident highlighted systemic vulnerabilities in municipal cybersecurity infrastructure, though officials confirmed no sensitive personal or financial data was compromised.
Source: https://www.govtech.com/security/after-cyber-attack-st-paul-minn-restores-public-internet
TPRM report: https://www.rankiteo.com/company/city-of-saint-paul
"id": "cit2502025092025",
"linkid": "city-of-saint-paul",
"type": "Ransomware",
"date": "7/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization’s existence"{'affected_entities': [{'customers_affected': 'Thousands of residents (reliant '
'on public Internet for work, '
'education, job applications)',
'industry': 'Public Administration',
'location': 'St. Paul, Minnesota, USA',
'name': 'City of St. Paul',
'type': 'Municipal Government'},
{'customers_affected': 'Library patrons (students, job '
'seekers, families)',
'industry': 'Education/Library Services',
'location': 'St. Paul, Minnesota, USA',
'name': 'St. Paul Public Library',
'type': 'Public Library System'},
{'customers_affected': 'Residents using recreation '
'centers',
'industry': 'Public Recreation',
'location': 'St. Paul, Minnesota, USA',
'name': 'St. Paul Parks and Recreation',
'type': 'Recreation Centers'}],
'customer_advisories': ['Restoration of public Internet access in libraries '
'and recreation centers',
'Launch of new permitting/licensing platform (PAULIE)',
'Assurance of safe and open network access for '
'residents'],
'data_breach': {'data_exfiltration': 'Yes (some data posted online by '
'attackers)',
'personally_identifiable_information': 'No',
'sensitivity_of_data': 'Low',
'type_of_data_compromised': 'Non-sensitive data'},
'date_detected': 'July 2023 (exact date unspecified)',
'date_publicly_disclosed': 'Late July 2023 (state of emergency declared)',
'date_resolved': 'October 2023 (partial restoration announced on a Thursday; '
'exact date unspecified)',
'description': "A ransomware attack in July 2023 disrupted St. Paul's public "
'Internet and city services, leading to a full system '
'shutdown. The city restored services with strengthened '
'safeguards, including network segmentation and modern '
'security measures. No ransom was paid, though some '
'non-sensitive data was leaked online. The FBI and Minnesota '
'National Guard assisted in the response.',
'impact': {'brand_reputation_impact': 'Potential negative impact due to '
'service disruption and data leak, '
'though mitigated by proactive '
'communication and restoration efforts',
'data_compromised': 'Yes (non-sensitive data posted online)',
'downtime': 'Months (July to October 2023, partial restoration)',
'identity_theft_risk': 'Low (non-sensitive data exposed)',
'operational_impact': 'Disruption of city services, including '
'public Internet access, permitting, '
'financial systems, and communications',
'systems_affected': ['Public Wi-Fi and Internet-based systems '
'(libraries, recreation centers, City Hall)',
'Permitting and licensing platform (PAULIE)',
'Financial and payment platforms',
'Geographic information systems',
'Telephones and email',
'Legislative and public meeting systems']},
'investigation_status': 'Ongoing (FBI and Minnesota National Guard involved; '
'no further updates provided)',
'post_incident_analysis': {'corrective_actions': ['Network segmentation',
'Simplified public access '
'with fewer logins',
'Modern safeguards '
'implemented']},
'ransomware': {'data_exfiltration': 'Yes (non-sensitive data posted online)',
'ransom_paid': 'No'},
'references': [{'source': 'Twin Cities News Service (TNS)'}],
'response': {'communication_strategy': ['Public announcements by Mayor Melvin '
'Carter and city officials',
'Statements from St. Paul Public '
'Library and Parks and Recreation '
'directors',
'Emphasis on equity and community '
'impact'],
'containment_measures': ['Complete network shutdown of Wi-Fi and '
'Internet-based systems',
'Isolation of public Internet traffic '
'from internal networks'],
'incident_response_plan_activated': 'Yes (state of emergency '
'declared, FBI and Minnesota '
'National Guard involved)',
'law_enforcement_notified': 'Yes (FBI involved)',
'network_segmentation': 'Yes (public Internet traffic segmented '
'from internal networks)',
'recovery_measures': ['Phased restoration of systems (public '
'Internet, PAULIE platform, '
'financial/payment systems, GIS, '
'telephones/email, legislative systems)',
'Testing and validation of restored '
'systems'],
'remediation_measures': ['Network segmentation (public Internet '
'separated from internal systems)',
'Simplified access with fewer logins',
'Modern safeguards implemented'],
'third_party_assistance': ['FBI',
'Minnesota National Guard '
'(cybersecurity experts)']},
'stakeholder_advisories': ['Public announcements by Mayor Melvin Carter',
'Statements from St. Paul Public Library (Deputy '
'Director Rebecca Ryan) and Parks and Recreation '
'(Director Andy Rodriguez)'],
'title': 'St. Paul Ransomware Attack and System Restoration',
'type': 'Ransomware Attack'}