Minnesota Activates National Guard Over St. Paul Cyberattack

The governor of Minnesota ordered military reservists to assist the city government of state capital city St. Paul as it recovers from a cyberattack.

See Also: Why Cyberattackers Love ‘Living Off the Land’

Cyber forces from the state National Guard will “collaborate with city, state and federal officials to resolve the situation and mitigate lasting impacts,” Gov. Tim Walz said Tuesday. Officials from the city of St. Paul said the intrusion came to light early Friday, when its IT and cybersecurity team “confirmed malicious threat actors were coordinating a digital attack.” Emergency response and public safety services were not affected by the attack.

Walz said the city requested assistance from National Guard, whose deployments to local emergencies are typically done at the discretion of the governor. “The scale and complexity of this incident exceeded both internal and commercial response capabilities,” Walz said in an executive order authorizing the deployment.

After attempting to contain the intrusion over the weekend and failing, city officials said they initiated on Monday “a full shutdown of our information systems as a defensive measure to contain the threat.” This has triggered “citywide service outages,” including disrupting Wi-Fi access in city buildings and network access to the city’s internal applications.

“This was a deliberate, coordinated digital attack, carried out by a sophisticated external actor – intentionally and criminally targeting our city’s information infrastructure,” said Mayor Melvin Carter in a Monday press conference. A declaration of emergency signed by Carter enabled the city’s emergency management and IT teams to begin working directly with local, state and federal agencies, including the FBI, on the response. Those teams are continuing to investigate the extent of the attacker’s network breach, and said they don’t yet know if the hacker accessed sensitive data.

Minnesota officials haven’t said if the attack involved ransomware. Taking systems offline is a tactic often used to respond to such an attack.

The city said that it’s also “retained two national firms with deep cybersecurity expertise to support our recovery,” and that it’s working to investigate and contain the incident, and rebuild affected systems.

If the city was hit by ransomware, it would be far from the first such victim. Other American cities pummeled by crypto-locking malware have included Atlanta in 2018, Baltimore and New Orleans in 2019 and Dallas in 2023.