August 5, 2025 | St. Paul, Minnesota The City of St. Paul is in the midst of one of the most disruptive cyber incidents in its history, prompting officials to extend a local state of emergency by 90 days as authorities continue efforts to recover from the attack. The breach, which began on July 25, has crippled digital infrastructure across city departments and forced officials to take the unprecedented step of disconnecting all systems from the internet. Mayor Melvin Carter, who first declared the emergency last week, now has expanded authority to fast-track recovery contracts and coordinate response efforts without standard bureaucratic delays. 

The decision to prolong the emergency was backed unanimously by the City Council on Friday, citing the need for continued access to external cybersecurity support. 

“This attack is unlike anything we’ve dealt with before—targeted, deliberate, and highly complex,” Carter said. “Our priority is restoring essential services while ensuring the safety and integrity of our systems.” 

Cyber Forensics, Shutdowns, and Gradual Recovery 

As a defensive measure, the city effectively “unplugged” itself from the internet early last week, halting online water bill payments, internal email communications, and police database lookups. Even municipal phone lines, which rely on VoIP technology, went dark temporarily. 

City officials have been slowly bringing services back online only after thorough inspection and clearance from forensic investigators, who are working alongside national cybersecurity firms, the FBI, and the Minnesota National Guard. 

Cloud-based systems and customer service lines for departments such as Parks and Recreation and the Public Library have already been restored, but many internal digital operations remain offline. 

While 911 and other emergency services were not impacted, day-to-day governance has been significantly hindered. Staff across departments have reverted to manual processes, echoing the response seen earlier this year in Abilene, Texas, when a separate cyberattack led to a complete IT overhaul. 

Unlike many recent municipal cyberattacks, St. Paul has not received a ransom demand, leaving questions about the motive and intent behind the intrusion. Mayor Carter noted that no evidence has yet surfaced indicating that sensitive data was accessed or exfiltrated, but investigations are still underway. 

The FBI and the Minnesota National Guard’s cybersecurity unit are leading the probe into the origins and scale of the breach. Meanwhile, the city’s own Office of Technology and Communications has acknowledged that the incident quickly overwhelmed its response capacity. 

“This was not something we could handle internally,” said a city spokesperson. “It required a level of expertise and scale we simply didn’t have in-house.” 

Ramsey County, which operates several shared services with St. Paul, is also preparing to vote on its own emergency declaration this week. 

While the county’s systems have not been compromised, officials believe the measure would help streamline future coordination and potentially open avenues for financial reimbursement from state and federal agencies. “This isn’t just about technology—it’s about ensuring continuity of essential services and protecting public trust,” said City Council President Rebecca Noecker. 

St. Paul’s experience reflects a broader and increasingly urgent trend. According to cybersecurity analysts at Comparitech, U.S. public institutions have suffered over 500 ransomware attacks since 2018, costing more than $1 billion in downtime and recovery. The number of such attacks doubled in 2024 alone, with 88 recorded incidents—up from 41 in 2022. Cybersecurity experts warn that as municipalities continue to digitize operations, they are becoming prime targets for sophisticated cybercriminals, especially those seeking to exploit gaps in funding, training, and infrastructure. 

Looking Ahead 

City officials have urged residents to remain patient as systems are carefully restored over the coming weeks. A dedicated resource hub for updates and service availability has been made available on the city’s official website, stpaul.gov. “This is a marathon, not a sprint,” Mayor Carter said. “We’re working around the clock to restore our systems safely and build stronger defenses for the future.”