St. Paul Cyber Attack: City Services Crippled as Officials Rush to Restore Critical Systems

(St. Paul) — St. Paul officials declared a local state of emergency late Monday after a sophisticated cyberattack crippled the city’s computer network, forcing most online services offline and prompting Governor Tim Walz to activate Minnesota National Guard cyber-protection teams for support. Citywide shutdown • Online bill-pay, permitting, property-tax lookup and public records portals remain inaccessible. • Police, fire and EMS dispatch continue to operate on isolated systems; 911 service is unaffected. • Employees have been ordered to power down non-essential workstations while forensic teams hunt for malware. Governor’s response Walz’s emergency order cites “the magnitude and complexity of the cybersecurity incident” and mobilizes Guard units specialized in network forensics, threat containment and system restoration. The teams are coordinating with the FBI and the Department of Homeland Security’s Cybersecurity & Infrastructure Security Agency (CISA). Possible ransomware Multiple officials confirmed that encrypted files and ransom notes were discovered on core servers, indicating a likely ransomware campaign, though no group has publicly claimed responsibility. City spokesperson Lily Thompson said St. Paul “will not negotiate with criminal actors” and is restoring data from offline backups. Impact on residents • Expect delays for license renewals, housing inspections and municipal court payments. • Paper forms are available at City Hall and neighborhood service centers. • Residents needing to report non-emergency issues should call 651-266-8989 until the online “St Paul Connect” app is restored. Expert analysis Cybersecurity analyst Mark Collier of SecureNorth Labs warns that municipalities remain prime targets: “Legacy software, tight budgets and sprawling networks create a perfect storm. Attackers know cities can’t tolerate downtime, so ransom demands soar.” What’s next The city has not given an official timeline for full restoration but says incremental services will return “in the coming days.” Residents are urged to monitor stpaul.gov and the city’s official X (Twitter) account @cityofsaintpaul for updates. How to stay protected 1. Ignore unsolicited emails claiming to fix St. Paul accounts. 2. Verify payment portals: only use links shared by the city’s verified social channels. 3. Update personal passwords and enable multi-factor authentication. Authorities encourage anyone with information about the breach to contact the FBI Minneapolis field office.