St. Paul Ransomware Attack Triggers National Guard Deployment

On July 25, 2025, the city of St. Paul, Minnesota pulled the plug on its own network. What began that morning as a detected intrusion escalated rapidly into a full defensive shutdown — Wi-Fi dark across city buildings, library systems offline, payment portals disabled — after officials concluded they were facing something beyond their capacity to contain. Mayor Melvin Carter described it as “a deliberate, coordinated digital attack carried out by a sophisticated external actor”, language that within days would prompt an unusual response: Governor Tim Walz activated the Minnesota National Guard’s cyber protection unit to assist the city.

Military cyber units assisting municipalities is not unheard of, but it remains rare enough to mark the severity of what St. Paul was dealing with. The attack had, by July 29, exceeded the city’s response capacity — a threshold that triggered not just the Guard deployment but FBI involvement and what Carter formally declared a local state of emergency. The emergency declaration wasn’t rhetorical; it unlocked resources and authorities needed to coordinate a response across agencies that don’t normally share operational control.

The immediate operational impact was a forced regression to analog methods. Library patrons couldn’t check out books. Residents couldn’t pay bills online. City Hall lost its Wi-Fi. Emergency services remained operational — the shutdown was selective, not total — but the disruption to routine municipal functions was substantial and visible. A city of 300,000 people was, for days, running on paper and phone calls where it had expected digital continuity.

In August 2025, officials confirmed what had been suspected: the attack was ransomware. The Interlock ransomware group claimed responsibility, and the city disclosed that it had paid nothing — instead isolating the threat through the complete network shutdown that had caused the visible disruptions. The decision to sacrifice operational continuity rather than negotiate is increasingly common in ransomware response, but it carries real costs: the same GovTech report noted that the attack was first detected on July 25, meaning the city ran degraded for days while working with the Guard and FBI to secure systems.

What’s notable in the response is what didn’t happen. There was no ransom payment, no rapid restoration from backups that left the incident quietly resolved. St. Paul’s approach — public acknowledgment, deliberate degradation of its own capabilities to contain the threat, and a call for military assistance — treats ransomware as something closer to a natural disaster or physical attack than to a technical malfunction. The National Guard’s cyber unit is trained for exactly this, but its deployment for a municipal incident signals that the gap between local IT capacity and serious threat actor capability has grown wide enough to require federal-military bridging.

The incident also sits at an inflection point in how ransomware gets attributed and discussed. Carter’s description — “deliberate, coordinated, sophisticated” — is careful language, neither minimizing nor sensationalizing. The Interlock claim, when it came, was unverified by officials but consistent with a group known for targeting public-sector infrastructure. The result is a case study in what transparent disclosure of a ransomware incident looks like when the affected party chooses visibility over discretion, and when the response escalates beyond the technical into the operational and political.

Sources

• St. Paul, MN, was hacked so badly that the National Guard has been deployed — Ars Technica
• Minnesota calls in national guard after capital city slammed by ‘digital attack’ — The Guardian
• National Guard Activated as Cyber Attack Hits St. Paul, Minn. — GovTech
• St. Paul, Minn., Breach Confirmed as Ransomware Attack — GovTech