What Happened — and What It Cost Saint Paul
On July 25, 2025, Saint Paul detected unauthorized access across City systems. The attacker exfiltrated 43 GB of data from the Parks and Recreation department and encrypted systems across multiple city departments. Recovery took over three months and required partnerships with the FBI, Minnesota IT Services, the Minnesota National Guard, and private cybersecurity firms.
Milestones: From Detection to Restoration
Saint Paul's recovery was methodical and publicly documented — a transparency model other municipalities should study. Each milestone reflects a department-by-department, system-by-system rebuild.
Incident Detected — Emergency Response Activated
Unauthorized access detected across City systems. IT teams took systems offline to contain the spread. Emergency services (911, police, fire) remained operational on isolated infrastructure. FBI engagement initiated.
Containment & Partnership Engagement
Minnesota IT Services (MNIT), Minnesota Department of Public Safety, and the Minnesota National Guard Cyber Team joined response efforts. Private cybersecurity forensics firms engaged to assess scope and begin recovery planning.
Operation Secure Saint Paul — Password Reset Completed
City-wide credential reset operation completed across all active employee accounts. All staff required to create new passwords through a secure, out-of-band verification process before regaining system access.
PAULIE Permitting Platform Launched
Saint Paul launched the PAULIE digital permitting platform — a new system built on restored infrastructure. Permits and inspections moved to the new platform rather than restoring the compromised legacy system.
Public WiFi Restored at Libraries & Recreation Centers
Public internet access restored at Saint Paul Public Library branches and Parks & Recreation facilities — the first public-facing systems brought back online after the incident.
Online Payments Restored — Garbage & Water Bills
Online payment systems for utility billing (garbage and water) restored. City issued public warnings about fraudulent invoices being sent to residents by bad actors during the outage period.
75%+ of City Systems Restored
Mayor's office confirmed over 75% of all City systems restored and operational. Recovery work on remaining systems continued into late 2025 under ongoing monitoring with state and federal partners.
What the Incident Cost — Beyond the Ransom
Saint Paul paid no ransom — but "free" is the wrong word. The real cost was measured in months of operational disruption, staff time, contract resources, and irreversible data exposure affecting residents.
43 GB Exfiltrated from Parks & Rec
Forty-three gigabytes of Parks and Recreation department data was confirmed stolen before systems were taken offline. Data likely included employee records, program participant data, and operational files. Exposure scope for affected residents has not been fully disclosed.
90+ Days of Degraded City Services
Residents and businesses experienced disrupted permitting, billing, and digital services for over three months. Staff reverted to paper-based processes. Departments that relied on shared city infrastructure were broadly affected regardless of whether they were directly targeted.
Fraudulent Invoice Campaign
Threat actors exploited the publicly known outage window to send fraudulent invoices to Saint Paul residents. The City had to issue public warnings about fake bills — adding a social engineering layer on top of the ransomware incident itself.
5-Agency Response & Private Contractors
Recovery required simultaneous engagement of the FBI, Minnesota Dept. of Public Safety, MNIT, the National Guard Cyber Team, and private cybersecurity firms — a resource expenditure that smaller municipalities could not sustain independently.
Emergency Services Never Disrupted
911, police, and fire department operations remained fully operational throughout the incident — a critical success. Isolation of emergency infrastructure from general city systems proved to be an effective architectural decision.
Public Communication Hub Maintained
Saint Paul maintained a live, public-facing Digital Security Incident Info Hub throughout the recovery — providing milestone updates, payment guidance, and FAQ responses. This transparency model reduced misinformation and built resident trust during a difficult period.
Where Browser-Layer Security Would Have Changed the Outcome
Ransomware doesn't materialize from thin air. It enters through a vector — and in the vast majority of municipal incidents, that vector is the browser: a phishing page, a credential harvesting site, or a malicious download. Here is where isolation would have intervened.
Credential Theft Prevention
Browser isolation renders suspicious sites in a remote cloud container. Keystrokes typed into a phishing page never reach the attacker's server — they interact with a pixel stream, not a live page. If Saint Paul's initial access was credential-based (consistent with 58% of MN incidents), isolation stops the attack at step one.
MNIT 2025 CIR: Compromised credentials = 58% of all incidentsMalware Delivery Blocked at the Browser
Ransomware payloads are commonly delivered via drive-by downloads, malicious email links, or weaponized documents opened in browser tabs. A cloud enterprise browser executes all web content in an isolated container — malware cannot escape to the endpoint, and the container is discarded after each session.
Attack pattern: web-delivered payload executionData Loss Prevention Before Exfiltration
43 GB left the Parks & Recreation network. Browser-layer DLP controls monitor and block file uploads, copy/paste of sensitive data, and form submissions — regardless of which application the user is in. Exfiltration through web-based channels would have been blocked or flagged in real time.
Confirmed: 43 GB exfiltrated from Parks & Rec dept.Session Isolation Limits Lateral Movement
One of ransomware's most damaging phases is lateral movement — spreading from an initial foothold to other systems on the network. If the compromised session runs in a cloud-isolated container, the attacker's access is bounded by that session's permissions and cannot pivot to adjacent systems through the browser.
Saint Paul: multiple departments affected by single incidentWhole-of-State Deployment — No Infrastructure Needed
Cloud enterprise browsers require no on-premises appliances. Under MNIT's Whole-of-State program, every municipality in Minnesota — including those without a dedicated IT department — could be protected through a browser-based policy. Saint Paul's recovery required 5 agencies; prevention could come through 1 platform.
MNIT: 3,300+ eligible Whole-of-State entitiesAI-Generated Phishing — Zero Signature Required
If Saint Paul's initial vector was a phishing email (consistent with attack patterns), modern AI-generated phishing pages evade all signature-based filters. Browser isolation is signature-agnostic — it doesn't need to recognize a threat to contain it. Every unknown page is isolated by default.
MNIT 2025 CIR: adversarial AI explicitly flagged as escalating threat"Emergency services remained operational throughout the incident. We did not pay a ransom. Our priority was restoring services as quickly as possible while keeping Saint Paul residents informed at every step."— Saint Paul Emergency Management, Digital Security Incident Info Hub, 2025
From Response to Resilience — The Security Improvements Saint Paul Implemented
Saint Paul's public documentation acknowledges that the incident drove meaningful security improvements. These reflect the same capabilities a cloud enterprise browser operationalizes — at the browser layer, before incidents begin.
City-Wide Credential Reset
Operation Secure Saint Paul completed a full credential rotation across all staff accounts using an out-of-band verification process. Browser-layer isolation would prevent this from ever being necessary by stopping harvesting at the point of entry.
System Segmentation — Emergency Services Isolated
Emergency services infrastructure was already isolated enough to remain operational. Post-incident work extended this segmentation model to additional departments — a key resilience principle aligned with Zero Trust architecture.
New Platform Architecture (PAULIE)
Rather than restoring the compromised permitting system, Saint Paul built PAULIE — a new platform on clean infrastructure. This architectural reset reflects a Zero Trust principle: don't restore trust, re-establish it from a clean state.
Browser-Layer Threat Prevention
Saint Paul's security improvements address recovery and segmentation — but do not publicly document a browser isolation or secure web gateway capability. The attack vector remains open. Without browser-layer protection, the next incident starts from the same entry point.
Proactive DLP for Web Channels
43 GB was exfiltrated before containment. Data loss prevention at the browser layer — blocking uploads, monitoring form submissions, controlling copy/paste — would have reduced or eliminated exfiltration volume during the attack window.
AI-Aware Phishing Defense
Saint Paul's FAQ acknowledges the incident involved social engineering techniques. MNIT's 2025 CIR explicitly flags adversarial AI as an escalating threat. Browser isolation is the only defense mechanism that is inherently signature-agnostic — effective against AI-generated threats by design.
Saint Paul Incident — Key Questions Answered
Based on Saint Paul's public Digital Security Incident Info Hub, the following questions represent the most common resident and stakeholder concerns during the incident.
Saint Paul City Departments — Official Contacts
For questions related to the cybersecurity incident, bill verification, or service restoration status, contact the relevant department directly using the numbers below. For emergencies, always call 911.
Saint Paul's Incident Is a Documented Roadmap — for Defenders and Attackers
The attack vector, the timeline, the exfiltration volume, and the recovery cost are all public. Minnesota municipalities that haven't closed the browser-layer gap are operating on borrowed time. The question is whether the next incident is a case study or a prevention story.