Introduction

In July 2025, the City of St. Paul, Minnesota, was hit by a major ransomware attack that disrupted several city services and forced officials into emergency mode. The attack was carried out by Interlock, a ransomware group known for stealing sensitive data and publishing it online.

What started as suspicious activity on the city’s network quickly turned into a large-scale security breach. Within days, St. Paul had declared a state of emergency, called in the Minnesota National Guard’s cyber team, and begun working with federal investigators to contain the damage.

In this blog, we’ll look at who Interlock is, how the attack happened, what data was stolen, the steps taken by the government, and what we can all learn to stay protected against such threats.

Unmasking Interlock Group

Interlock is a ransomware group known for targeting organizations, stealing sensitive data, and then leaking it publicly if a ransom isn’t paid. On their leak website, they share not only the stolen files but also statistics meant to highlight the scale and cost of ransomware attacks.

According to Interlock:

94% of ransomware attacks could have been avoided with better patch management.
Businesses face an average of 9.7 days of downtime after such attacks, often leading to major revenue losses.
The average total cost of disruption from ransomware is estimated at $4.45 million, which includes lost revenue, legal fees, incident response, and damage to reputation.

Alongside these figures, Interlock posts a bold social message:

“The Corporate Secrets They Never Wanted You to See”

July 25: The Digital Break-In

On July 25, 2025, Interlock launched a ransomware attack against the City of St. Paul, Minnesota. The group infiltrated the city’s internal network, targeting critical systems and digital services. As part of their usual tactic, Interlock later uploaded proof of the breach to their leak website including folder structures and file samples to pressure the city into paying a ransom.

From the screenshots available, the stolen data appeared to come from the Parks and Recreation Department’s shared server. While the exact contents of the files are still under investigation, the breach reportedly involved around 43 GB of data.

The impact was immediate: several internal city systems went offline, public Wi-Fi and library networks were shut down, and online payment portals were suspended. While essential services like 911 were not affected, the attack disrupted day-to-day city operations and forced officials to act quickly to contain the threat.

Inside the City’s Counterstrike

The City of St. Paul and the State of Minnesota responded quickly once the ransomware attack was detected. Here’s how the events unfolded:

July 25, 2025 – Governor’s Executive Order

The attack began on July 25, disrupting critical systems and city services. Governor Tim Walz issued Emergency Executive Order , noting that the scale and complexity of the incident exceeded St. Paul’s internal and commercial response capabilities.

The order authorized the Minnesota National Guard to provide cyber protection support, along with equipment and resources, to help ensure vital municipal services continued without interruption.

July 29, 2025 – Local State of Emergency Declared

Mayor Melvin Carter declared a local state of emergency, activating the city’s Emergency Operations Center and enabling a coordinated response with local, state, and federal partners. In consultation with cybersecurity vendors, Minnesota IT Services, and federal law enforcement, the city shut down targeted systems to contain the threat. Officials stressed that emergency and public safety services remained fully operational, but many internal systems were offline.

August 1, 2025 – Emergency Extended 90 Days

The City Council voted unanimously to extend the state of emergency for 90 days. This extension allowed the city to continue its intensive forensic investigation, keep external resources engaged, and restore services in a controlled manner. Officials reported progress ,employees would be paid on time, customer service lines were being restored, and public safety operations remained protected. Leaders also emphasized resilience and a commitment to strengthening cybersecurity to prevent future incidents.

Recovery Efforts

After the attack, the city rolled out Operation Secure St. Paul , a focused plan to recover systems, tighten security, and protect anyone potentially affected. Here’s what they did:

Mass Password Reset : Around 3,500 city employees had to reset their passwords in person at the Roy Wilkins Auditorium to make sure accounts were secure.
Upgraded Cyber Defenses : New, advanced security software was installed on over 90% of city devices to block future intrusions.
Credit Monitoring for Staff : All affected employees were offered 12 months of credit monitoring and identity theft protection for peace of mind.
No Ransom Paid : Officials refused to meet attackers’ demands, focusing instead on securing systems and gathering evidence.
Partnering with the Experts : Worked alongside the FBI, the Minnesota National Guard cyber team, and private cybersecurity firms to investigate and restore operations.

Cybersecurity Takeaways from St. Paul

The St. Paul ransomware attack is a reminder that cybersecurity isn’t just an IT problem ,it’s everyone’s responsibility. Here are the key takeaways for both organizations and individuals:

Keep Systems Updated : Many attacks exploit old, unpatched software. Regular updates and patch management can stop threats before they start.
Use Strong, Unique Passwords : Weak or reused passwords make it easier for attackers to get in. Pair them with multi-factor authentication (MFA) for extra security.
Back Up Your Data : Keep secure backups offline or in a safe cloud storage. This ensures you can recover information even if systems are encrypted.
Watch for Phishing : Most ransomware starts with a single malicious email. Train yourself and your staff to spot suspicious links or attachments.
Have an Incident Response Plan : Know who to call, what systems to shut down, and how to communicate if an attack happens.

Final Words

The ransomware attack on St. Paul shows how quickly a city’s operations can be disrupted and how important it is to be ready. In just a few days, the city went from detecting suspicious activity to mobilizing the National Guard, working with the FBI, and rebuilding its systems under a 90-day emergency order.

Cyber threats aren’t slowing down, but with vigilance, preparation, and teamwork, communities can respond quickly and come out stronger. St. Paul’s experience is proof that resilience, transparency, and coordinated action matter just as much as technology when facing a crisis.