Cyber Forces Mobilized: St. Paul Battles Cyberattack with Guard’s Help

Summary

• Incident: A cyberattack detected on July 25, 2025 forced St. Paul to shut down its information systems.
• Response: Gov. Tim Walz activated the Minnesota National Guard’s cyber experts to help the city.
• Collaboration: City IT staff, two national cybersecurity firms and law enforcement, including the FBI, are working the response.
• Trend: Local governments remain frequent targets for attackers.
• Future Measures: The city has urged staff to take steps to protect their own digital security.

How the attack unfolded

In the early hours of Friday, July 25, 2025, the City of St. Paul’s security systems detected suspicious activity on its network. The city later shut down its information systems as a defensive measure. That caused citywide outages, including loss of Wi-Fi in city buildings, disruption to the library collection system and suspension of network access for many internal applications. Emergency services kept running. An earlier version of this article said public transportation systems were shut down; that was not reported by the city and has been removed.

The Guard steps in

Mayor Melvin Carter declared a local emergency and asked the state for help. Gov. Tim Walz then activated the Minnesota National Guard, saying the scale and complexity of the incident exceeded what the city could handle on its own. The Guard’s cybersecurity experts helped secure, restore and rebuild the city’s systems. A quote attributed to Major General Shawn Manke in an earlier version could not be verified and has been removed.

Who is working the response

The response brought together city technology staff led by Chief Information Security Officer Stefanie Horvath and technology director Jaime Wascalus, two national cybersecurity firms the city retained, and local, state and federal law enforcement, including the FBI. Layered help like this is becoming the norm for serious attacks on cities.

A wider problem for cities

St. Paul is not alone. Cities and counties across the country face attacks on underfunded and outdated systems. According to a report by the National Cyber Security Alliance, local governments are attractive targets because they hold large amounts of personal data and often have limited defenses.

What the mayor said

Carter described the incident in blunt terms. “This was a deliberate, coordinated digital attack, carried out by a sophisticated external actor—intentionally and criminally targeting our city’s information infrastructure,” he said on July 29. The quote attributed to him in an earlier version of this article could not be found in his remarks and has been replaced.

Advice for city staff

The city urged its employees to take precautions with their digital security at work and at home. Residents should also stay alert for scams that use news of the attack as bait.

Lessons from St. Paul

The attack on St. Paul shows how quickly a city can lose basic services when attackers get in, and how much outside help a serious incident takes. Cities that rehearse their response, keep offline backups and know whom to call will recover faster.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.