The city of St. Paul, Minnesota, has fallen victim to a ransomware attack attributed to the Interlock group, resulting in the exposure of 43GB of sensitive data. In response, city officials have opted to refuse the ransom and launched Operation Secure St. Paul, collaborating with the FBI and the National Guard.
On July 25, 2025, St. Paul, a city home to over 311,000 residents, experienced significant disruptions due to the cyberattack. The attack impacted various online payment systems and city services at public libraries and recreation centers, causing widespread operational challenges.
In addressing the breach, Minnesota Governor Tim Walz activated the National Guard’s cyber protection unit to assist in recovery efforts. Mayor Melvin Carter confirmed the nature of the attack as ransomware and firmly stated that the city would not pay the ransom, marking a clear refusal to engage with the attackers. This stance notably delayed the mayor’s State of the City address, emphasizing the attack’s far-reaching implications.
Interlock, a ransomware group that commenced operations in late 2024, has publicly claimed responsibility and alleged that they stole 43GB of data from the city’s servers. They have gone as far as to publish images purportedly showing documents acquired from St. Paul, criticizing the city’s security measures as “careless and irresponsible,” potentially compromising resident data.
The extent of the data breach remains unverified by city officials, who have yet to disclose specifics about the stolen information or how the hackers gained access. Nevertheless, the mayor’s office insists that they have maintained access to their systems and data, and the recovery operation has been designated as Operation Secure St. Paul.
As an immediate measure, the city is implementing a global reset of passwords for its approximately 3,500 employees, aimed at securing user accounts and preventing further unauthorized access. The FBI is spearheading the investigation, while the National Guard’s IT sector works on restoring critical city services post-password reset.
