On July 25, 2025, the city of St. Paul, Minnesota, faced a digital onslaught that brought its municipal systems to a standstill. What began as "suspicious activity" detected on the city's internal networks quickly escalated into a confirmed cyberattack, described by Mayor Melvin Carter as a "deliberate, coordinated digital attack" orchestrated by a sophisticated external actor. The breach targeted critical infrastructure, forcing the city to shut down its IT systems, including Wi-Fi in public buildings and online payment services. This unprecedented disruption prompted a state of emergency, as St. Paul grappled with the immediate fallout of an attack that has left residents and officials scrambling to restore normalcy.
The scale and complexity of the cyberattack overwhelmed St. Paul’s internal and commercial response capabilities, leading Governor Tim Walz to issue an executive order activating the Minnesota National Guard’s cyber protection unit. This marked a rare deployment of military resources to combat a cyber threat, underscoring the severity of the situation. The National Guard’s cyber forces are now working alongside city, state, and federal officials, including the FBI, to investigate the breach, secure compromised systems, and restore critical services. Governor Walz emphasized a commitment to “protecting the safety and security of the people of Saint Paul,” highlighting the urgency of mitigating the attack’s lasting impacts.
The cyberattack’s ripple effects have been felt across St. Paul’s 311,000 residents. Essential services like 911 and emergency response remain operational, but non-emergency functions, such as online bill payments, library systems, and Wi-Fi in city buildings, have been severely disrupted. Mayor Carter noted that while the city holds limited resident data, there’s concern about potential exposure of employee information. The city’s defensive shutdown of systems has caused delays and inconveniences, with some workers unable to perform their duties and residents unable to access key online services. The declaration of a state of emergency has empowered local teams to mobilize additional resources, but the road to recovery remains uncertain.
This incident in St. Paul is not an isolated event but part of a troubling trend targeting municipal governments across the United States. Cities like Atlanta (2018), Baltimore (2019), and Dallas (2023) have faced similar ransomware-driven cyberattacks, which often paralyze critical infrastructure and demand hefty payments to restore access. While officials have not confirmed whether St. Paul’s attack involves ransomware, the proactive shutdown of systems suggests a familiar playbook. Cybersecurity experts warn that local governments, often underfunded in digital defenses, are prime targets for cybercriminals exploiting vulnerabilities to disrupt essential services and extract sensitive data.
As St. Paul battles this cyber crisis, the collaboration between local authorities, the National Guard, and federal agencies like the FBI signals a robust response to a modern threat. The city’s chief information security officer, Stefanie Horvath, emphasized that defensive measures were taken to limit the attack’s reach, but the investigation into its full scope is ongoing. For residents, the advice is clear: monitor financial accounts and exercise caution, as the potential for data breaches remains a concern. This cyberattack serves as a stark reminder of the vulnerabilities in our digital infrastructure and the need for increased investment in cybersecurity to protect cities from future assaults. St. Paul’s resilience will be tested, but with coordinated efforts, the city aims to emerge stronger and more secure.
SOURCE: https://san.com/cc/minnesota-activates-national-guard-after-capital-city-hit-by-cyberattack/