The City of St. Paul experienced a ransomware attack that disrupted critical municipal services for nearly three weeks. Hackers, attributed to a known cybercriminal group, breached the city’s systems and exfiltrated data, including work documents and copies of IDs belonging to Parks and Recreation employees. While the mayor confirmed no critical personal data of city employees or the public was accessed, the attack forced a system-wide shutdown, requiring over 3,000 employees to reset digital credentials. Online payment services for utilities (water, garbage) and department customer service lines were temporarily disabled, though later restored. The Minnesota National Guard’s cyber team was deployed to assist recovery, and the city remains in an active recovery phase with no confirmed timeline for full restoration. Financial costs and potential long-term reputational damage are still being assessed, with the mayor stating expenses will be disclosed post-recovery. The incident underscores vulnerabilities in government cybersecurity, prompting warnings for other entities to bolster defenses against similar threats.

The City of St. Paul, Minnesota, suffered a deliberate, coordinated ransomware attack in late July 2025, attributed to the ransomware group Interlock. The attack disrupted critical municipal services, forcing a complete shutdown of information systems, including Wi-Fi in public buildings, library services, and internal networks. Emergency services like 911 remained operational, but over 3,500 employees had to reset credentials in person. The attackers leaked 43 GB of stolen data from multiple files and folders, though the city refused to pay the ransom, opting for backup restoration instead. Recovery prioritized public safety, financial stability, and daily operations, with over 90% of systems upgraded with advanced security tools post-incident. The attack overwhelmed the city’s response capacity, prompting Minnesota Governor Tim Walz to activate the National Guard’s cyber protection unit for support. The incident highlighted vulnerabilities in municipal cybersecurity, including outdated legacy systems and insufficient IT resources, despite no direct evidence of data misuse beyond the leak.

Peabody, MA Hit by Interlock Ransomware Attack Affecting 48,000 Residents The city of Peabody, Massachusetts, confirmed a June 2025 data breach exposing sensitive information of 48,004 state residents, including Social Security numbers, financial account details, and driver’s licenses. The ransomware group Interlock claimed responsibility, alleging it stole 124 GB of data from Peabody’s government network. However, city officials have not verified the group’s claims, and details about ransom demands or the attack’s entry point remain undisclosed. Peabody detected the breach on July 7, 2025, after discovering inaccessible systems. Investigations revealed unauthorized access between June 13 and July 8, 2025, during which attackers exfiltrated data. Affected individuals were notified and offered free credit monitoring through IDX, with an enrollment deadline of May 5, 2026. About Interlock Emerging in October 2024, Interlock is a ransomware gang known for dual-extortion tactics stealing data and encrypting systems before demanding payment. Since its inception, the group has claimed 41 confirmed attacks, plus 48 unverified incidents. In 2025 alone, Interlock targeted six government entities, including: - West Lothian Council (UK) – May 2025 breach - St. Paul, MN – July 2025 breach (refused ransom) - Box Elder County, UT – August 2025 breach (81,664 affected) - Shelbyville Police Department (KY) – October 2025 breach - Fargo Park District (ND) – October 2025 breach Broader Impact on U.S. Government Entities In 2025, 82 confirmed ransomware attacks on U.S. government bodies compromised data for over 630,000 individuals. Recent incidents include breaches at Midway, FL; Winona County, MN; New Britain, CT; and Tulsa International Airport (OK). Such attacks disrupt critical services from emergency dispatch to court records while forcing agencies to weigh ransom payments against prolonged downtime and fraud risks. Peabody, a coastal city of 55,000 residents in Essex County, joins a growing list of municipalities grappling with ransomware threats.

In late July 2025, the City of St. Paul, Minnesota, suffered a ransomware attack that disrupted critical municipal services, though emergency response and public utilities remained operational. The incident was initially labeled a 'digital security incident' to avoid premature speculation, but it was later confirmed as ransomware. The attack aligns with a rising trend of cyber threats targeting local governments, exploiting vulnerabilities like outdated infrastructure, budget constraints, and understaffed IT teams. While the immediate financial ransom demand was not disclosed, historical cases (e.g., Baltimore’s 2019 RobbinHood attack with $18.2M recovery costs) suggest potential long-term expenses in system restoration, consulting fees, and lost revenue. The attack underscored the need for zero-trust security, pre-planned recovery strategies, and transparent public communication to mitigate operational disruptions and erosion of public trust. No evidence of data exfiltration was explicitly mentioned, but the outage risked delays in non-emergency services like billing, permits, and public records.