Our Response to the Digital Security Incident

Since July 25, the City of Saint Paul has been responding to a digital security incident. We've partnered with state and federal agencies - including the FBI, Minnesota Department of Public Safety, Minnesota IT Services, Minnesota National Guard, and other cybersecurity experts. Together, our teams have worked tirelessly to:

  • Protect core City services, including emergency response and public safety.
  • Take significant and proactive steps to defend our City and limit the impact of this incident.
  • Securely recover and restore City systems. 

Digital security is a global issue. This is one of a growing number of recent ransomware attacks, including on other major U.S. cities. We're not unique in being targeted by criminal threat actors. Because we acted swiftly and decisively, we were able to limit the impact, safeguard critical services, and position our systems for a safe and secure recovery operation.

What's Next

We are prioritizing restoration of critical applications and continue to safely and securely bring our systems back online. Full restoration is expected soon.

Watch: Update from Mayor Carter on August 11

Key Milestones

Ongoing: Systems Restoration

The City is continuing phased service restoration, working to validate and bring systems back online. This includes:

  • Stabilizing core services and prioritizing systems for structured, secure recovery.
  • Ensuring systems meet heightened security standards before reactivation.
  • Supporting employees and customers through ongoing recovery efforts.

August 20: Reestablished Email Connection with Key Partners

The City re-established email connectivity with key partners after providing independent confirmation of the security of our Microsoft 365 environment. This milestone reinforced trust and collaboration with our partners.

August 14: Minnesota National Guard Deployment Ends

After 17 days of continuous support, the Minnesota National Guard’s Cyber Protection Team formally completed its mission in Saint Paul. Their demobilization marks the successful conclusion of a critical partnership that strengthened the City’s recovery efforts.

Watch: Mayor Carter Thanks Minnesota National Guard

August 11: Data Released from Network Drive

After the City refused to pay ransom, a threat actor released 43 gigabytes of data from a Parks and Recreation network drive. A forensic review is ongoing, and the City will continue following all legal and regulatory requirements for notification. The City remains committed to transparency and protecting our employees and residents.

August 10-13: Operation Secure Saint Paul

We hosted a global password reset and device security check at Roy Wilkins Auditorium from August 10-13, with the support of Team Saint Paul and the Minnesota National Guard. 

  • Over the course of three days, we completed a password reset and device check for over 3,000 City employees.
  • We continue to work with individual staff members to bring them safely back online.
  • This operation was a critical step in allowing us to begin securely restoring City systems

Watch: Behind the Scenes at Operation Secure Saint Paul

August 8: Successfull Payroll for City Employees

The City's payroll team worked around the clock to ensure we were able to pay employees as planned on August 8, 2025. 

August 3-9: Building Operation Secure Saint Paul

In early August, the City began coordinating an enterprise-wide password reset and device security check. This initiative, Operation Secure Saint Paul, was a critical step in ensuring we could safely bring systems back online. 

Critical incident reponse - including forensic investigation, system restoration, and enhanced security - continued in tandem with Operation Secure Saint Paul planning. 

August 2: Installation of Enhanced Endpoint Detection on City Devices

The Minnesota National Guard fully deployed into City facilities. They partnered with the City to begin installing enhanced endpoint detection across all City devices.

August 1: Customer Service Phone Lines Restored

The City was able to bring customer service phone lines back online just days after the full network shutdown. We securely activated and staffed critical phone lines while planning for advanced system recovery.

Emergency services - including 911 - remained operational throughout the digital security incident.

July 28: Defending Data Through Network Shutdown

The threat actor attempted to encrypt City data on the compromised virtual servers, and demanded a ransom to restore encrypted data. We took immediate and decisive action to:

  • Lock out the threat actor with a full network shutdown.
  • Begin secure recovery and restoration efforts.

Because the City had secure back-ups, we were able to restore data access without paying a ransom. 

At the same time, we activated the City's Emergency Operations Center to coordinate our response with intelligence and investigation support from the federal government.

July 25-27: Detecting and Containing the Threat

The City was able to contain the threat shortly after detecting it on July 25. We took swift action to:

  • Deactivate compromised accounts.
  • Isolate the affected servers.
  • Increase monitoring across City systems.
  • Engage national incident response firm.
  • Ensure critical public safety services continued without interruption. 

Important: Bill Payment Information

How to Pay Your Bill

We are now able to accept online payments for garbage and water bills. Some online services remain temporarily unavailable. No late fees will be assessed during this period. Additional billing and service updates will be shared once systems are restored. 

Visit the following webpages for more specific billing and payment information:

Garbage Bills  Water Bills  Permit and License Payments  

Protect Yourself from Invoice Fraud

We’ve been made aware of fraudulent invoices claiming to be from the City of Saint Paul. Please do not click on any links or email attachments if you are unsure of their origin. Find more information on spotting and preventing invoice fraud.

Report a concern hero img

Emergency Services Are Fully Operational – Contact Us Online for Everything Else

If you’re experiencing an emergency, call 911 immediately. All emergency services remain available. For all other needs, please use the links below to report issues or find contact information while City systems continue to come back online.

Department Directory

What to Know

We are continuing to restore communications platforms across the City. At this time, please email for faster service. You can also use the department phone lines listed below.

Please note: City staff are currently not accessible through direct phone lines. Please use email to contact individual staff members. If you don't have a direct email, please use the department email listed below.

Frequently Asked Questions

Last Edited: August 26, 2025