The City of St. Paul is grappling with a significant cyberattack that has crippled many of its digital services, prompting Mayor Melvin Carter to declare a local state of emergency and Minnesota Governor Tim Walz to activate the state’s National Guard for assistance. The incident, described by the mayor as a “deliberate, coordinated digital attack,” was first detected on Friday, July 25, 2025.
According to city officials, cybersecurity systems first flagged suspicious activity on Friday morning. The situation escalated over the weekend, leading the city to initiate a full shutdown of many of its information systems on Monday as a defensive measure to contain the threat. “This was not a system glitch or technical error,” Mayor Carter stated at a press conference on Tuesday. “This was a deliberate, coordinated digital attack carried out by a sophisticated external actor intentionally and criminally targeting our city’s information infrastructure.”
The shutdown has had a widespread impact on municipal operations. Wireless internet is down in all city buildings, including public libraries and recreation centers. Online payment portals for services like water and sewer bills are unavailable, though officials have assured residents they will not be penalized with late fees during the outage. Additionally, St. Paul library’s collection management systems and network access for many internal applications are offline. However, essential emergency services, including the 911 operations center, remain fully functional and unaffected.
The scale of the attack prompted the city to seek external help. In an executive order, Gov. Walz noted that “the magnitude and complexity of the cybersecurity incident have exceeded the city’s response capacity.” He immediately activated the Minnesota National Guard’s cyber protection support unit to aid in the recovery. “We are committed to working alongside the City of Saint Paul to restore cybersecurity as quickly as possible,” Gov. Walz said in a statement. “The Minnesota National Guard’s cyber forces will collaborate with city, state, and federal officials to resolve the situation and mitigate lasting impacts.”
The FBI is leading the criminal investigation into the breach, supported by Minnesota IT Services and two national cybersecurity firms. The motive behind the attack remains unknown, and Mayor Carter confirmed that he is not aware of any ransom demand having been made. Cybersecurity experts note that such attacks on government entities are increasingly common, often with financial motives.
Concerns about data compromise are high, particularly for city employees, who have been urged to take precautionary measures with their personal and professional accounts. Mayor Carter stated that the city holds “very limited data on specific residents,” but the full extent of any data exfiltration is still under investigation. Jaime Wascalus, St. Paul’s Director for the Office of Technology and Communications, emphasized the severity of the situation, calling the city “the victims of a serious crime.”
Neighboring Ramsey County has confirmed its systems are not affected by the attack and that it is limiting digital interactions with the city as a precaution. As St. Paul officials and their partners work to investigate the breach and restore services, there is no timeline for when systems will be fully operational again. “We will not restore services until we have complete confidence in our understanding of the incident,” Wascalus said.
