One Year On: How St. Paul's Ransomware Attack Played Out

A look back at the July 2025 attack that took a US state capital offline and triggered the first National Guard cyber deployment in Minnesota's history.

By Content Team

Aug 5, 2026

ON THIS PAGE

In late July 2025, St. Paul, Minnesota discovered what the city called a "deliberate, coordinated" cyberattack on its systems. Online services went down, including water bill payments. Emergency 911 and trash collection kept running. The city declared a local state of emergency and later extended it as recovery dragged on.

Governor Tim Walz activated the Minnesota National Guard to assist — the first time the state had deployed it for a cyber incident. Mayor Melvin Carter said the risk to residents' personal data was low, since the city held little sensitive resident information, but could not rule out exposure of employee data.

The incident was later confirmed as ransomware. The Interlock group published roughly 43GB of stolen city data. Fraudulent invoices posing as city bills circulated during the response, and officials warned residents not to click unfamiliar links or attachments.

City systems were restored over the following weeks. Carter's line at the time still holds up as the useful lesson: rushing systems back online would have made the problem worse.

Source: CBS News Minnesota

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?