---
title: "One Year On: How St. Paul's Ransomware Attack Played Out"
description: A look back at the July 2025 attack that took a US state capital offline and triggered the first National Guard cyber deployment in Minnesota's history.
canonical_url: https://codekeeper.co/ticker/st-paul-cyberattack-disrupts-city-services
---

# One Year On: How St. Paul's Ransomware Attack Played Out

A look back at the July 2025 attack that took a US state capital offline and triggered the first National Guard cyber deployment in Minnesota's history.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Aug 5, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fst-paul-cyberattack-disrupts-city-services%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fst-paul-cyberattack-disrupts-city-services%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fst-paul-cyberattack-disrupts-city-services%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fst-paul-cyberattack-disrupts-city-services%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fst-paul-cyberattack-disrupts-city-services%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fst-paul-cyberattack-disrupts-city-services%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

In late July 2025, St. Paul, Minnesota discovered what the city called a "deliberate, coordinated" cyberattack on its systems. Online services went down, including water bill payments. Emergency 911 and trash collection kept running. The city declared a local state of emergency and later extended it as recovery dragged on. Governor Tim Walz activated the Minnesota National Guard to assist — the first time the state had deployed it for a cyber incident. Mayor Melvin Carter said the risk to residents' personal data was low, since the city held little sensitive resident information, but could not rule out exposure of employee data. The incident was later confirmed as ransomware. The Interlock group published roughly 43GB of stolen city data. Fraudulent invoices posing as city bills circulated during the response, and officials warned residents not to click unfamiliar links or attachments. City systems were restored over the following weeks. Carter's line at the time still holds up as the useful lesson: rushing systems back online would have made the problem worse. Source: [CBS News Minnesota](https://www.cbsnews.com/minnesota/news/st-paul-cyberattack-fraudulent-invoices-bills/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fst-paul-cyberattack-disrupts-city-services%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fst-paul-cyberattack-disrupts-city-services%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fst-paul-cyberattack-disrupts-city-services%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fst-paul-cyberattack-disrupts-city-services%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fst-paul-cyberattack-disrupts-city-services%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fst-paul-cyberattack-disrupts-city-services%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Vulnerabilities CISA Flags Two Actively Exploited SonicWall SMA1000 Vulnerabilities Sep 3, 2026](https://codekeeper.co/ticker/sonicwall-sma1000-cisa-exploited-vulnerabilities)

[KnowledgeDeliver LMS Zero-Day Used to Deploy Stealthy In-Memory Web Shell Aug 13, 2026](https://codekeeper.co/ticker/zero-day-flaw-in-knowledgedeliver-lms)

[University of Nottingham Students 'Scared and Anxious' After Major Cyber-Attack Aug 12, 2026](https://codekeeper.co/ticker/university-of-nottingham-hack-student-data-breach)

[Cyberattacks $86 Million Crypto Heist Tied to Tampered Ledger Hardware Oct 14, 2026](https://codekeeper.co/ticker/ledger-device-hack-86m-crypto-stolen)