Cyber Incident Info Hub

Frequently Asked Questions

1. What occurred during the incident?

   On July 25, 2025, our cybersecurity systems detected suspicious activity involving compromised accounts tied to a critical backup server. This was a high-risk area because of the elevated access those accounts carried. Our teams immediately deactivated the accounts, isolated affected servers, and began enhanced monitoring.

   On July 26, we engaged a cybersecurity vendor—a nationally recognized incident response firm—to help contain the threat and conduct a forensic investigation. By July 27, we took additional precautions by disabling VPN access for most employees to prevent further attacker movement across the network. On July 28, the City shut down the broader network to stop the attacker and eradicate them from City systems.

   That decisive action protected critical services while we shifted into a full recovery mode.

   From day one, all police, fire, 911, and emergency operations continued uninterrupted. 

2. When did the City first know about this breach?

   Suspicious activity was detected on July 25, 2025. Our cybersecurity systems flagged the attempted access to backup servers, which gave us an early window into the intrusion.  

3. Did the City work with law enforcement to investigate this breach?

   Yes. The City partnered closely with the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency, and other state and local law enforcement partners.  

4. Why didn’t your monitoring systems detect this intrusion?

   Advanced threat actors often spend weeks or months in reconnaissance before attempting to deploy ransomware. That activity can be very subtle, which is why many organizations — from Fortune 500 companies to other U.S. cities — have faced similar incidents despite robust defenses.

   What matters is that our endpoint detection identified the attacker before encryption or large-scale improper access occurred. That gave us the ability to shut down the network, protect critical services, and restore our systems safely. 

5. Who was the threat actor?

   The City was attacked by a sophisticated cybercriminal organization.  

6. Was the City's entire system improperly accessed?

   No. The full network shutdown was a defensive move, not evidence of total improper access. By taking that step, we contained the attacker and prevented further spread. Systems were restored in phases using verified clean backups, with forensic review and departmental testing at every step before they are brought back online.  

   This careful process protected both employees and residents and ensured that restored systems are safe. 

7. Was this preventable with basic cybersecurity measures?

   This was not a case of missing “basic” measures. Prior to the incident, Saint Paul already had multi-factor authentication for remote and VPN access, advanced monitoring tools, and secure backups. Those measures positioned us to contain the attack and recover on our own terms.

   Unfortunately, ransomware groups are persistent and sophisticated. Even cities that have invested heavily in cybersecurity — Baltimore, Cleveland, Dallas — have been targeted and impacted. The question is not whether you can stop every attack, but whether you are prepared to respond decisively when one occurs. 

8. How many Saint Paul residents had their personal information accessed?

   The attacker exposed about 43GB of data from a Saint Paul Parks and Recreation network drive. The City first disclosed this information on August 11, 2025.  

   Since then, the City has contracted with a forensic investigator to securely review the affected data and identify individuals whose information may have been improperly accessed. That review is now complete, and individual notification is being sent to affected employees and residents.  

   Individuals whose data was improperly accessed will be offered 12 months of IDX identity protection services at no cost. Enrollment instructions are included in each notification. 

9. How do I know if my personal information was accessed?

   If the City has contact information for affected employees and residents, these individuals will be notified by mail or email. If the City doesn’t have sufficient contact information for affected individuals, the City is also posting information on our website and reaching out to major media outlets. We've partnered with IDX to create a dedicated call center for employees and residents who were affected. If you have questions or want to confirm whether you were included, call 1-888-204-2071. 

10. Why should Saint Paul employees or residents trust the City with their personal information after this?

    We’ve been transparent in public updates. We are providing identity protection services to individuals whose information was accessed as part of the cyber incident. We have rebuilt systems from secure backups — not taking shortcuts. And we are investing aggressively in stronger defenses.

    The City commissioned a comprehensive, independent After-Action Review following the incident. That review surfaced clear lessons that the City is putting into practice: strengthening our defenses, tightening how we manage access and credentials, and improving how we detect and respond to everchanging threats.  

    Our systems today are more secure than they were before July 25, 2025, and our commitment is to keep strengthening them continuously. 

11. Shouldn’t taxpayers expect that their data would be protected?

    Yes, and cybersecurity threats are escalating worldwide — and no city or company has been immune. Even with significant investments, organizations like MGM Resorts, Colonial Pipeline, and cities like Dallas and Baltimore have been targeted.

    In Saint Paul, those same taxpayer investments gave us the tools we needed: monitoring systems to detect the attacker, clean backups to restore from, and a trained workforce to respond. As a result, we avoided paying ransom, kept critical services running, and positioned our systems for a safe and secure recovery operation. 

12. What organizations assisted with the City's response?

    This response was a true partnership. Alongside the City's Office of Technology & Communications, we have worked with:  

    • Minnesota National Guard Cyber Protection Team  
    • Bureau of Criminal Apprehension (BCA)  
    • Department of Public Safety – Homeland Security & Emergency Management (HSEM)  
    • Office of Minnesota Information Technology (MNIT)  
    • Federal Bureau of Investigation (FBI)  
    • Department of Homeland Security – Homeland Security Investigations (HSI)  
    • Cybersecurity and Infrastructure Security Agency (CISA)  

    These organizations brought critical expertise and capacity to the City’s recovery.