St. Paul officials say the cyberattack that has wrought havoc on its online services for weeks was a ransomware attack, a sophisticated form of online assault in which hackers demand payment in order to let users back into their systems.
The city paid no money and instead shut down its network to isolate the threat, according to a written briefing provided by city spokeswoman Jennifer Lor. Because of the ongoing criminal investigation, the city is limited in what information it can share, the briefing said.
The cyberattack was detected on July 25, leading to the shutdown and subsequent disruptions in internet service at city libraries and recreation centers. City Hall lost its Wi-Fi, and online payment systems that handle water and sewer bills did not work. St. Paul’s 911 and other emergency response systems remained functional.
St. Paul has been working with a cybersecurity unit of the Minnesota National Guard and the FBI to secure city systems and investigate the source of the attack. To counter it, the city has backed up all data and is testing servers as it works to restore and rebuild its internal systems, according to the briefing.
City officials have maintained that residents’ data was not at risk, and that much of the data is kept in cloud-based applications that were untouched by the attack, according to the briefing.
“The city maintains very little data” on residents, Mayor Melvin Carter said after the attack. “The city doesn’t have Social Security numbers on random residents. The city doesn’t maintain that type of sensitive information on community members who don’t have some fiscal relationship with the city.”
Cyberattacks in other cities have exposed personal data. In Dallas, for example, the data of more than 30,000 people was exposed by a 2023 attack. In ransomware attacks, a malicious actor typically encrypts files, making them useless, and then demands that the target pay to have them decrypted.
After the attack was detected, St. Paul shut down city computer networks in an effort to contain the attack. Those preventative shutdowns — and not the attack itself — hamstrung systems across the city and forced St. Paul into analog operations.
