Desk live·
ForensicPost
Ransomware/Analysis/File 25-1106

Saint Paul Still Recovering Long After the Attack

Saint Paul was reported still recovering long after the attack. The corpus records start dates and restart dates and almost never records the curve between them.

Constructed geometry · not a chart of case data
TargetCity of Saint Paul
ActorUnattributed
S. Rosler11 min readConfidence: medium2 sources reviewed

Reporting months after the July attack described the City of Saint Paul as still recovering, with services restored progressively rather than at a single point.

This Desk Asked For Exactly This Data At 25-1008

After Jaguar Land Rover restarted production, the corpus recorded that a stopped system does not resume — it restarts from a different state — and that nobody publishes the recovery curve: when output returned to plan, when the supply chain normalised, what the twelve-month total was.

Saint Paul is the closest thing in this database to that curve being visible, and it is visible only because a public body kept publishing.

Public Accountability Produced The Data

A city runs an incident information hub, answers to elected officials, and is subject to public records law. A company that has restarted has every incentive to stop talking.

So the corpus can describe municipal recovery in more detail than corporate recovery, not because cities recover differently but because they cannot stop describing it — the same visibility asymmetry filed at 25-0630 and 25-1123.

What "Recovering" Means After The Systems Are Back

Rebuilding rather than restoring, because restoring risks reintroducing the actor. Re-establishing integrations one at a time. Reconciling records created on paper during the outage. Replacing credentials across every system. Handling the notification and support obligations arising from the published data at 25-0815.

None of that appears in an incident timeline, and all of it is staff time a municipality does not have spare — the capacity finding at 25-0730. Graded medium: the recovery is described qualitatively in reporting and this desk has no cost figure or completion date.

This is an analysis file

Built on published reporting of the city’s recovery, listed below. No cost total or completion date is established. Corrections: corrections@forensicpost.com.

Sources
  1. St. Paul, Minnesota, fell victim to a cyberattack in July. It’s still recovering.Smart Cities Dive
  2. How St. Paul, Minn., recovered from a ransomware attackGovTech
S. Rosler
Covers extortion groups and leak-site economics. Verifies our sample sets.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary