St. Paul officials still dealing with summer cyberattack’s fallout

MINNEAPOLIS — July 25, 2025, will live long in the memories of St. Paul, Minnesota’s leaders and residents, as the city suffered a cyberattack from which it is still recovering.

Leaders acted quickly to contain the threat by deactivating compromised accounts, isolating affected servers and increasing monitoring, before shutting the entire city network down when they detected that the hackers were encrypting data. The race was on to then protect systems, recover data and ensure continuity of government operations, an effort that is still underway several months on and has included the Minnesota National Guard as well as federal, state and local agencies.

As of Oct. 22, the city said 75% of its systems had been restored, so the effects of the cyberattack are still being felt, although many functions are back to normal and city workers got paid on time. 

“July 25 will be burned into my memory,” Mary Gleich-Matthews, St. Paul’s deputy chief information officer, said during a panel discussion at last week’s GOVIT Leadership Summit and Symposium in Minneapolis.

Officials declined to comment on how the hackers entered the city’s systems. But the ransomware network Interlock took credit for the attack a few weeks after it happened, and claimed to have stolen and posted online 43 Gigabytes of data from the city’s parks and recreation department.

Initially, the city thought the hack was a standard cyberattack, one of millions that it and other state and local governments receive every day and successfully repel. But it quickly became apparent to St. Paul’s tech leaders, as well as their employees who worked through the weekend on response, that it was “bigger than we had originally thought,” said Jaime Wascalus, director and CIO in St. Paul’s Office of Technology and Communications, during a GOVIT session.

The incident was quickly escalated to city leadership, who activated an Emergency Operations Center to coordinate the response, then engaged with Minnesota Gov. Tim Walz about calling up the National Guard, which he activated that week to provide cybersecurity support and protection. The Guard’s Cyber Protection Team was deployed for 17 days before completing its mission to supplement the city’s employees and provide support.

“What I thought was, our team, our people are amazing, but we don't have enough of them,” Wascalus said. “When I heard that we had a special unit in Minnesota that had expertise in infrastructure and cyber security and they could help us, I was like, ‘Yes, sign us up.’”

Having partnerships and relationships in place helped make it easier for the National Guard to come in and help, and it meant that no one was “fighting for turf” because they understood their roles and responsibilities, Wascalus said.

“We had already done a lot of prep work in the event that this was going to be our first activation of the Guard cyber forces,” said Army Lt. Col. Brian Morgan, director of the Cyber Coordination Cell for the Minnesota National Guard, during the panel discussion. “We knew already who was going to go, because we had done some conversations and phone calls. Everybody who showed up to this thing on the federal side and the state side, I had already in my cell phone, from the [Federal Bureau of Investigation] to [the Minnesota Bureau of Criminal Apprehension] to [Homeland Security Investigations], the Secret Service to state stakeholders. These are all people we had already partnered with.”

The state also was prepared for such an eventuality as it has an emergency operations process, as well as a whole-of-state cybersecurity plan that emphasizes shared responsibility for threats and incidents as well as mutual aid.

Rick Schute, St. Paul’s director of emergency management, said training for cyberattacks and other incidents is crucial, especially through tabletop exercises, as well as building relationships with relevant agencies who could be brought in to help. He said it is a “fanciful notion” that employees and their leaders can rise to the occasion during such a trying time. Instead, he said they will revert to their level of training and planning.

“We will not rise to the occasion,” he said. “We will fall to our level of preparedness.”

And Gleich-Matthews said one “silver lining” of the cyberattack has been that it incentivized St. Paul officials to speed up their modernization efforts. That included rolling out the city’s new Permitting and Utilities, Licensing, Inspection Engine, known as PAULIE, in September. City officials said the “accelerated launch” would help “ensure uninterrupted access to core permitting and licensing services.”

“A lot of the old applications that we had been picking departments to replace for years and years and years couldn't come back,” Gleich-Matthews said. “They're gone. Sorry. And it's really exciting that we were able to say, ‘OK, now we're going to start fresh and we're going to try these new applications.’”