Saint Paul shut down its network after detecting a July 2025 ransomware intrusion, disrupting municipal technology and public access while emergency services continued. Recovery took months, and the city later confirmed theft of Parks and Recreation data involving 12,484 people.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Unauthorized access to systems, accounts, networks, or data.
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
Stolen, exposed, or otherwise compromised data was publicly released, posted, distributed, or offered for download.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Internal or external network connectivity was unavailable or materially impaired.
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
A specific application or software platform became unavailable or unusable.
Users were unable to authenticate, sign in, access accounts, or use identity-dependent services.
VPN, remote desktop, telework, remote administration, or other remote-access capabilities were unavailable or restricted.
The organization could not process, receive, issue, reconcile, or record payments normally.
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.
The actor explicitly threatened to publish or publicly release victim data or incident details.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
An authoritative source stated that no ransom or extortion payment was made.
Saint Paul, Minnesota, detected suspicious activity on July 25, 2025, involving privileged accounts and a backup server at Saint Paul Regional Water Services. The city’s detailed legislative timeline dates restrictions on most employee VPN access to July 27 and an attempted encryption of virtual servers followed by a broader network shutdown to July 28.
Gov. Tim Walz’s July 29 announcement and Emergency Executive Order 25-08 authorized National Guard cyber support after the incident exceeded the city’s response capacity. This was an operational municipal disruption, including effects from protective isolation, rather than proof that all city systems had been compromised.
The legislative timeline documents temporary customer-service phone arrangements, restricted communications, printed payroll statements and a large employee credential-reset and device-check operation. The city said emergency response and payroll continued.
The Sept. 18 city release confirms restoration of public internet, computers and printing at libraries and recreation centers. It also identifies recovery of financial/payment tools, GIS, phones, email, legislative tools and core library systems, alongside the Sept. 17 launch of the PAULIE permitting and licensing platform. Wider recovery was still underway.
Route Fifty’s Nov. 26 report describes continuing recovery and cites an Oct. 22 city milestone of roughly 75% of systems restored. It also reports that some legacy applications could not return and were being replaced. A major public-service milestone therefore did not establish complete technical recovery.
Cyber and ransomware confidence are confirmed by the city’s official accounts of attempted encryption and a ransom demand. Actual encryption extent remains uncertain; a defensive shutdown does not establish successful encryption across the network.
The city’s July 2, 2026, investigation report confirms about 43 GB of stolen data from a Parks and Recreation drive and personal information involving 12,484 people, including employees, former employees, interns, volunteers and recreation participants. Identifying data included names, addresses, phone numbers, birth dates and Social Security numbers. The city said core city-service data was not included, the material was exposed Aug. 11, 2025, and ransom was not paid. Its review and notifications establish data impact independently of the actor’s allegation.
An Interlock listing was discovered Aug. 11. Interlock’s claimed responsibility remains qualified because the reviewed city report does not name the group. The listing supports an allegation, not independently confirmed attribution.
The initial intrusion method, full access window, exact extent of encryption, complete application-by-application restoration dates and total final cost remain unestablished. The city says it commissioned an independent after-action review; that statement does not substitute for the review’s unreleased findings.
Our July 29 coverage described the initial emergency response. The Feb. 11, 2026, state assistance announcement authorized $1.2 million; a later funding announcement or data-notification milestone does not by itself demonstrate continued operational disruption.
Operations are presumed resolved. The latest precise quantified ongoing-recovery observation reviewed is Oct. 22, 2025; later city reporting describes rebuilt systems and completed data review. No reviewed source provides an exact day when all affected functions recovered. The end date remains unset, and July 2026 breach reporting does not extend the operational-impact clock.
Interlock listed City of St Paul/stpaul.gov; ransomware.live discovered the claim Aug.11,2025. The city independently confirms approximately43GB of data stolen/exposed from a Parks and Recreation drive and no ransom payment. Its reviewed official report does not name Interlock, so responsibility remains a qualified actor claim.
Municipal service context for public internet, library, payment, permitting and internal-system disruption. This does not imply a failure of all city services or emergency response.
Saint Paul is the affected municipal government’s headquarters and administrative site anchor. Emergency operations continued; the relation does not imply every building or physical utility service failed.
Signed-in members can report an error, update, or missing source.
