Most St. Paul services restored following ransomware attack

ST. PAUL, Minn. (FOX 9) - St. Paul officials say the city is "in recovery" after shutting down its network in response to a ransomware attack that happened back in July. 

READ MORE: St. Paul hack confirmed as ransomware attack, Mayor Carter discusses next steps

Update on St. Paul Cyberattack

What they're saying:

Officials shared updates on the following St. Paul services:

• Phone lines: Full department phone line service was restored after priority lines, such as emergency services, were restored early in the incident.
• Payments: Online bill payments for St. Paul Regional Water Services have been fully restored and no late fees have been charged during the outage. Payment systems for pools and golf courses has also been restored.
• Libraries: Public internet access at libraries is currently down. However, the integrated card catalog and checkout systems are restored, and libraries remained open throughout the incident.
• Public works: All payments are processed through a secure third-party vendor, and municipal hauling services were not impacted.
• Department collaboration: Sharepoint, Outlook, and Teams are now available, along with transparency tools such as Legistar and Granicus. Access to "key network and shared drives across departments" has also been restored, city officials say.

What's next:

St. Paul officials say they will launch a new platform called "PAULIE" (Permitting and Utilities, Licensing, Inspection Engine) on Sept. 17.

The program is meant to facilitate "modern, secure, and resident-centered service delivery" following the cybersecurity breach.

The latest updates from city officials can be found by clicking here.

St. Paul hack response

The backstory:

St. Paul Mayor Carter declared a state of emergency in St. Paul when the hack was first detected in July.

"This was not a system glitch or technical error. This was a deliberate, coordinated digital attack carried out by a sophisticated external actor intentionally and criminally targeting our city’s information infrastructure," Mayor Carter said.

The city then initiated a full shutdown of their information systems as a defensive measure to contain the threat. Wireless internet is down in city buildings, the St. Paul library’s collection management systems are down, as is network access for internal applications.

Carter said they are intentional, proactive decisions taken to isolate and secure city systems.

"They are necessary steps to limit exposure, preserve system integrity and protect sensitive information as investigation continues," Carter said. "This breach was intentionally caused by a criminal, external threat actor." 

Minnesota Gov. Walz then activated the National Guard’s cyber protection support.

"We are committed to working alongside the City of Saint Paul to restore cybersecurity as quickly as possible," Gov. Walz said. "The Minnesota National Guard’s cyber forces will collaborate with city, state, and federal officials to resolve the situation and mitigate lasting impacts. Above all, we are committed to protecting the safety and security of the people of St. Paul."

The hack was later confirmed as a ransomware attack, but Mayor Carter said the city has not paid any ransom.