Desk live·
ForensicPost
Ransomware/Public sector/File 25-0726

A City Stopped Taking Payments

A cyberattack on Saint Paul, Minnesota beginning 25 July 2025 disrupted internal networks, online payment portals and public Wi-Fi. Officials described a deliberate, coordinated attack on city infrastructure.

Constructed geometry · not a chart of case data
JurisdictionUSAthe affected organisation’s jurisdiction, not the actor’s suspected origin
TargetCity of Saint Paul
ActorUnattributed
D. Kennedy12 min readConfidence: high3 sources reviewed

A cyberattack against the City of Saint Paul, Minnesota began on 25 July 2025, disrupting core city systems including internal networks, online payment portals and public Wi-Fi. City officials characterised it as a deliberate, coordinated attack by a sophisticated external actor against critical city infrastructure.

Sequence as reportedCity statements and contemporary reporting
TimeEventEvidence
25 Jul 2025Attack beginsCity statement
28 Jul 2025Broader network shut down to evict the actorCity statement
Aug 2025State National Guard deployed to assistExecutive order
11 Aug 2025Data published after ransom refusedContemporary reporting

Public Wi-Fi Is The Detail That Locates The Harm

A payment portal going down is an inconvenience for most residents and a real problem for some. Municipal public Wi-Fi is, for a meaningful population, how they get online at all — in libraries, recreation centres and public buildings.

The corpus files availability harm constantly and usually in commercial terms: production halted at 25-0902, invoicing stopped at 25-0606. Here the people worst affected are the ones with the fewest alternatives, which is the funding-gap population at 25-0918 experiencing the outage rather than paying for the defence.

A City Cannot Tell Residents To Go Elsewhere

This desk filed at 25-1126 that a resident who needs a permit, a licence or a benefit payment has one place to obtain it. Saint Paul is that argument with dates attached.

And unlike a company, a city cannot defer the obligation. Water still has to be billed, permits still have to be issued, and the statutory duties continue while the systems that discharge them do not.

How we reported this

Compiled from city statements and public reporting, listed below. The characterisation of the actor is the city’s. No group attribution is asserted here. Corrections: corrections@forensicpost.com.

Sources
  1. Cyber incident information hubCity of Saint Paul
  2. 2025 St. Paul cyberattackWikipedia
  3. St. Paul, Minnesota, fell victim to a cyberattack in July. It’s still recovering.Smart Cities Dive
D. Kennedy
Identity and access reporter. Former DFIR consultant. Signal on request.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary