![\"St.](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/07\/STP-L-jea-02-ST_PAUL_HACK-0729.jpg\")
Mayor Melvin Carter. (John Autey \/ Pioneer Press)<\/p>\nSt. Paul Mayor Melvin Carter declared a state of local emergency on Tuesday following a days-long cyber attack on the city\u2019s Internet-based computer networks that led officials to call in the FBI and Gov. Tim Walz to enlist the Minnesota National Guard\u2019s cybersecurity experts.<\/p>\n
Mayor Melvin Carter. (John Autey \/ Pioneer Press)<\/p>\n
The data breach forced city officials on Monday to conduct a precautionary \u201ccomplete network shut down\u201d of its Wi-Fi and Internet-based systems, from public computer terminals within the St. Paul libraries to key networks at City Hall. As a result, many city services remain offline, other than 911 and other public safety operations.<\/p>\n
The investigation is being treated as a criminal matter.<\/p>\n
The mayor said he was not aware of any request for ransom, though the city is not the lead investigator, and it was unclear what information, if any, had been stolen.<\/p>\n
Unclear who is behind attacks, if data accessed<\/p>\n
It\u2019s also unclear who orchestrated the attack, or if they accessed any private employee or citizen data or other sensitive information.<\/p>\n
Nevertheless, the city took the unprecedented step of effectively unplugging itself from the Internet as a precaution.\u00a0 Libraries, rec centers and other buildings remain open, but with no access to Internet-based services.<\/p>\n
\u201cThis was a deliberate, coordinated, digital attack carried out by a sophisticated external actor, intentionally and criminally targeting our city\u2019s information infrastructure,\u201d said Carter on Tuesday, during a press conference outside the mayor\u2019s office that also was attended by St. Paul Police Chief Axel Henry and a number of City Hall officials.<\/p>\n
State of local emergency<\/p>\n
The state of local emergency declaration authorizes the city department of Emergency Management and the Office of Technology and Communications to call in support from local, state and federal partners while coordinating a response across departments.<\/p>\n
\u201cWe are the victim of a serious crime,\u201d said Jaime Wascalus, director of the city\u2019s Office of Technology and Communications, following the mayor\u2019s remarks.<\/p>\n
Carter joined Human Services Director Toni Newborn in a phone call Tuesday with leaders of the city\u2019s labor unions to alert them to the situation and address concerns, such as future payroll.<\/p>\n
\u201cObviously, we\u2019re concerned about payroll, but we\u2019re waiting to hear more about the situation,\u201d said Max Hall, a spokesperson for the American Federation of State, County and Municipal Employees, which represents many city workers.<\/p>\n
![\"St.](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/07\/STP-L-jea-04-ST_PAUL_HACK-0729.jpg\")
St. Paul Office of Technology Director Jaime Wascalus. (John Autey \/ Pioneer Press)
\n\u2018We\u2019ve never experienced this before\u2019<\/p>\n
The breach was first detected Friday, according to the mayor\u2019s office, and began with a report of suspicious activity to the Office of Technology and Communications, which discovered \u201can active digital security incident\u201d that \u201cimpacted the integrity of city information.\u201d<\/p>\n
Chief Information Security Officer Stefanie Horvath said the city\u2019s EDR \u2014 or Endpoint Detection and Response System \u2014 is intended to function \u201clike a force field on your computer\u201d and alerted the city to \u201cnefarious activity\u201d on Friday, spurring \u201ccontainment actions.\u201d<\/p>\n
\u201cWe\u2019ve never experienced this before,\u201d said Horvath, at the press conference. \u201cBut right now we have contained the risk to city systems. \u2026 It\u2019s been a very long 24 hours, as you can well imagine.\u201d<\/p>\n
The mayor\u2019s administration alerted city department directors, and the city\u2019s cybersecurity protection team found the breach was coming from within the city\u2019s servers. Affected accounts were deactivated, and the city hired a national cybersecurity firm for \u201cadvanced forensic investigation, containment and strategic response planning,\u201d according to the mayor\u2019s office.<\/p>\n
On Monday, the mayor\u2019s administration put the city\u2019s Emergency Operations Center in charge of managing the city\u2019s response to the breach.<\/p>\n
To make it difficult for third parties to steal sensitive information, a VPN, or Virtual Private Network, allows for an encrypted connection over the Internet, with the goal of enhancing security and privacy as data travels online, particularly on public networks. The VPN routes Internet traffic through a remote server, masks its origin, or IP address, and encrypts it.<\/p>\n
\u2018Complete network shutdown\u2019<\/p>\n
On Monday, the city disabled VPN access for all computer users except law enforcement and others needing access to public safety data, and the city \u201cinitiated a complete network shutdown to contain the incident,\u201d according to the mayor\u2019s office.<\/p>\n
The shutdown disabled public-facing Internet computer terminals throughout the library system and other Internet-based and Wi-Fi enabled systems, rendering many city services inoperable. The city\u2019s libraries and rec centers remained open Tuesday, without Internet access.<\/p>\n
The shutdown was \u201ca proactive step,\u201d according to the mayor\u2019s office, and \u201cnot the result of the ongoing digital security incident.\u201d<\/p>\n
Walz issued an executive order Tuesday deploying cyber protection experts from the Minnesota National Guard to assist St. Paul, and \u201cto ensure continuity of vital services and the safety and security of St. Paul residents,\u201d according to the governor\u2019s office.<\/p>\n
A Minnesota National Guard spokesperson did not specify how many guard members had been deployed, other than to say it was \u201ca limited number of specialty experts.\u201d<\/p>\n
\u201cOur service members bring years of specialized training and operational experience in cybersecurity,\u201d said Army Brig. Gen. Simon Schaefer, the guard\u2019s Director of Joint Staff, in a written statement. \u201cWe are confident in their capabilities and proud to support our local partners in safeguarding critical systems.\u201d<\/p>\n
Ramsey County, law enforcement<\/p>\n
Ramsey County\u2019s information systems were not affected by the digital security incident or the precautionary network shutdown, though the county took steps to discourage county workers from emailing city departments or otherwise interacting online with city offices.<\/p>\n
\u201cOut of an abundance of caution, we have taken steps to limit digital interactions while we continue to monitor the situation,\u201d said Casper Hill, a county spokesman. \u201cThe county is actively coordinating with the city of St. Paul to ensure continuity in coordinated emergency communications and public safety response.\u201d<\/p>\n
The Ramsey County Emergency Communications Center, which handles 911 calls for St. Paul, were not affected.<\/p>\n
Meanwhile, St. Paul Police have asked for the public\u2019s patience when it comes to non-emergency services such as making an online police report, obtaining a copy of a police report or having evidence returned.<\/p>\n
St. Paul police usually look up information in law enforcement databases to check if someone they encounter has a warrant or is otherwise wanted by authorities, said Ramsey County Sheriff Bob Fletcher.<\/p>\n
The sheriff\u2019s office warrant and criminal history office is closed overnight, but Fletcher said he\u2019s been staffing it with one person during those hours, so officers can call to get real-time information during the network shutdown.<\/p>\n
Cyber attacks against municipalities, other groups<\/p>\n
Between 2018 and December 2024, there were 525 individual ransomware attacks carried out against municipalities and other government organizations in the U.S., according to Comparitech, a computer security and online privacy research company. Those breaches exposed more than 5 million records, with numbers escalating each year, and 2.4 million records exposed in 2024 alone.<\/p>\n