St. Paul races to restore systems after ransomware attack forces massive data reset

The city of St. Paul is preparing for a large-scale data reset involving approximately 3,500 employees in the wake of a ransomware attack that has kept municipal systems offline for more than two weeks.

City officials confirmed Sunday that the cyberattack, which began in the early hours of July 25, was a ransomware incident. Press Secretary Jennifer Lo said the breach prompted the shutdown of the city’s internal network, crippling online services and disrupting government operations. The attack forced the suspension of online payments for garbage and water services, disabled internet access in government buildings, and put the personal data of thousands of city workers at risk.

Deputy Mayor Jaime Tincher said the city has refused to pay the ransom demanded by the unidentified attackers. “It was a sophisticated attack trying to get access to our systems and our information,” Tincher said. “At this point, we have found no evidence that any of our data was taken.” Officials opted to isolate and shut down the network as a precautionary measure to block further intrusion.

In the coming days, employees will begin scrubbing their data, resetting passwords, and reestablishing accounts, a process expected to take up to three days. While the city has not provided an estimated date for full restoration, officials said essential services such as 911 response will not be affected and city facilities remain open.

The city declared a local state of emergency after the breach and enlisted assistance from the FBI, Minnesota National Guard, Minnesota Bureau of Criminal Apprehension, Department of Public Safety, and the state’s Office of Information Technology. A private cybersecurity firm has also been hired to aid in the response.

Minnesota House Republicans have called on Mayor Melvin Carter to provide details about which systems were accessed, when they will be restored, and whether any personal or operational data was compromised. Lawmakers requested a formal response from the mayor by Tuesday.

Tincher described the incident as a “significant event” likely to cost taxpayers hundreds of thousands of dollars or more. The FBI is leading a criminal investigation alongside the city’s recovery efforts.