Minnesota’s National Guard has been activated to help respond to a cyberattack that shut down municipal computer systems in St. Paul, the state capital. The city also declared a state of emergency on Friday, July 25, after detecting “suspicious activity” on its internal systems.
In a press conference on Tuesday, July 29, St. Paul Mayor Melvin Carter blamed “a sophisticated external actor” for the “deliberate” and “coordinated” targeting of the city’s information infrastructure.
The city shut down its systems Monday, July 28, in an effort to contain the threat. Services, including bill paying through the city’s online portal, are currently unavailable. Wi-Fi in libraries and other city buildings has been shut down. Carter stressed, however, that emergency services like 911 remain fully operational.
Download the SAN app today to stay up-to-date with Unbiased. Straight Facts™.
Point phone camera here
“We recognize that these outages have created inconveniences for residents and city staff alike,” Carter said. “While these disruptions are difficult, they are necessary steps to limit exposure, preserve system integrity and protect sensitive information as our investigation and recovery efforts continue.”
Attacks on cities
Local governments have increasingly found themselves in the crosshairs of hackers, particularly those deploying ransomware. The cybersecurity firm Sophos reported in August that 34% of state and local government organizations were hit by ransomware in 2024. Cities targeted include Columbus, Ohio, where officials had to notify half a million people in 2024 that their information was exposed after a ransomware gang attempted to extort the city.
Attacks on city governments are common for ransomware gangs, cybersecurity analyst Dominic Alvieri told Straight Arrow News.
“No city or state is off limits,” Alvieri said. “Unfortunately, even the Minneapolis Public Schools suffered a significant attack a few years ago.”
National Guard’s role
Minnesota Gov. Tim Walz, D, said the National Guard’s “cyber forces” were deployed to “collaborate with city, state and federal officials to resolve the situation and mitigate lasting impacts.”
Walz signed an executive order that said the National Guard will assist St. Paul “until the emergency conditions caused by the cyberattack subside or until it is rescinded by proper authority.”
Carter said the city is also working with two cybersecurity firms, as well as the FBI, to “trace the source and scope of the breach” and support the city in its recovery.
Source of attack unknown
No group or individual has taken credit for the St. Paul attack, Alvieri said, and the hackers’ motives are unclear.
Carter said that while the city retains little information about residents, data regarding government employees could be at risk.
He said he is unaware of any ransom demands, even though the neighboring city of Minneapolis was targeted by a ransomware group in November 2024.
An analysis by Straight Arrow News of ransomware leak sites on the dark web found no acknowledgment of the attack.
