The City of Saint Paul refused to pay the ransom demanded. On 11 August 2025 approximately 43 gigabytes of city data was published on the threat actor’s leak site.
The Corpus Argued This And Could Not Evidence It
At 25-0728 this desk observed that refusals do not signal back: organisations that decline to pay generally do so quietly, there is no register of declined demands, and the information reaching the market is therefore biased towards paying.
This is a documented refusal with a documented consequence. It is one of very few files in this database where the corpus can say what happened when an organisation said no.
And What Happened Is The Thing Everyone Knew Would Happen
The data was published. There was no reprieve, no negotiated withdrawal, no partial release. The threat was carried out in full.
That is not an argument for paying. Set it against 25-0507, where PowerSchool paid roughly $2.85 million, received a video of the attackers claiming to delete the only copy, and watched the same data reappear in extortion emails to school districts three months later.
The two files together are as close as this corpus comes to a controlled comparison. One paid and the data circulated. One refused and the data was published. The difference in outcome is the money.
A Public Body Is Better Placed To Refuse Than Most
Payment is frequently prohibited or politically impossible for a US municipality, budgets are public, and the negotiation happens in the open — the conditions at 25-0918.
Those constraints are usually filed as a disadvantage. Here they removed a decision that has destroyed value elsewhere in this database. An organisation that cannot pay does not have to evaluate a suppression promise that 25-1231 establishes is unverifiable by construction.
The Residents Still Bear It
Forty-three gigabytes of municipal data concerns residents and employees who were not party to the decision, per the volume caution at 25-1111 about what a gigabyte figure does and does not convey.
The corpus records the refusal as the better of two bad options and does not pretend it was costless.
Compiled from public reporting, listed below. The 43GB figure derives from the attacker’s publication and is recorded with the caution this desk applies to all such figures. Corrections: corrections@forensicpost.com.