Governor Tim Walz declares emergency response as “sophisticated external actor” targets state capital’s digital infrastructure

Updated: July 29, 2025 - 1:30 PM CDT

Key Developments

Minnesota Governor Tim Walz activated cyber protection assets from the Minnesota National Guard Tuesday afternoon in response to an ongoing, sophisticated cyberattack that has overwhelmed the City of Saint Paul’s ability to respond independently. The attack, which began Friday and persisted through the weekend, has forced the shutdown of critical city systems and prompted both state and local emergency declarations.

National Guard Under Siege: A Comprehensive Analysis of Cybersecurity Breaches and Insider ThreatsExecutive Summary The United States National Guard, a critical component of the nation’s defense infrastructure, has faced an alarming series of cybersecurity breaches and insider threats that expose significant vulnerabilities in military data protection. The most recent and concerning incident involves the Chinese state-sponsored hacking group Salt Typhoon, which maintainedBreached CompanyBreached Company “The magnitude and complexity of the cybersecurity incident have exceeded the city’s response capacity,” Walz announced in an executive order that took effect immediately. “The Minnesota National Guard’s cyber forces will collaborate with city, state, and federal officials to resolve the situation and mitigate lasting impacts. Above all, we are committed to protecting the safety and security of the people of Saint Paul.”

Timeline of the Attack

Friday, July 25: Saint Paul’s cybersecurity protection systems detected “suspicious activity” early Friday morning, triggering an immediate investigation.

Weekend: The cyberattack persisted throughout the weekend, targeting “critical systems and digital services” and causing “significant” disruptions that impaired the city’s ability to provide vital services.

Monday, July 28: City officials initiated a “full shutdown of our information systems as a defensive measure to contain the threat.”

Tuesday, July 29:

  • 11:45 AM: Governor Walz activates Minnesota National Guard cyber protection unit
  • Afternoon: Saint Paul Mayor Melvin Carter declares local state of emergency
  • Ongoing: FBI leads federal investigation with state and local partners

What We Know About the Attack

At a press conference Tuesday, Saint Paul Mayor Melvin Carter confirmed this “was not a system glitch or technical error” but rather “a deliberate, coordinated digital attack carried out by a sophisticated external actor intentionally and criminally targeting our city’s information infrastructure.”

“We are the victims of a serious crime,” added Jaime Wascalus, director of the city’s Office of Technology and Communications.

Key Attack Details:

  • Duration: Started Friday, July 25, continuing through Tuesday
  • Scope: Targeted critical city systems and digital services
  • Perpetrator: “Criminal, external threat actor” described as sophisticated
  • Motive: Carter said he would not speculate on motive, but confirmed “no ransom has been requested”
  • Investigation: FBI leading federal response with state and local partners

Systems and Services Affected

The cyberattack has caused widespread disruptions across Saint Paul’s digital infrastructure:

Currently Down:

  • Wi-Fi access in all city buildings
  • Online payment systems (water bills and other city services)
  • City library collections management systems
  • “Wide range” of internal city applications
  • Pool pass scanning systems at public pools

Still Operational:

  • 911 emergency services (though with some “back-end challenges”)
  • Libraries and recreation centers remain open
  • Essential emergency response systems

City officials announced that no late fees will be assessed while online payment systems remain down.

Emergency Response Escalation

State Level Response: Governor Walz’s executive order authorizes the Adjutant General to deploy necessary personnel, equipment, and resources from the Minnesota National Guard’s cyber protection unit. The state’s general fund will cover costs associated with the emergency response.

Local Emergency Declaration: Mayor Carter issued a local declaration of emergency, stating: “To ensure our team has full and immediate access to every available resource, I am issuing a local declaration of emergency to give our teams the tools we need to move quickly and respond with the urgency this situation demands.”

Multi-Agency Investigation:

  • Federal agencies, including the FBI, are currently leading the investigation
  • The city has retained two national cybersecurity firms to support recovery efforts
  • Saint Paul’s Emergency Operations Center has been activated

Data Security and Resident Impact

Potential Data Exposure: While the investigation continues, Mayor Carter stated that the city has “limited” data on residents who are not employed by the city and asked city employees to remain vigilant about their personal data. Carter noted that while the investigation is ongoing, officials continue working to confirm “what systems were accessed and what data, if any, may have been stolen.”

“Let me be clear: We have very limited data on specific residents,” Carter emphasized.

Employee Precautions: City employees are being urged to take precautionary steps to safeguard their digital security in both their personal and professional lives.

Historical Context

This represents one of the most significant cybersecurity incidents to affect a major Minnesota municipality. The deployment of National Guard cyber assets for a municipal cyberattack is relatively rare and underscores the severity of the situation.

Governor Walz, who served 24 years in the Army National Guard before entering politics, has previously activated the Guard for civil emergencies, but this marks a notable use of the Guard’s specialized cyber protection capabilities for a municipal crisis.

Current Status and Next Steps

Immediate Actions:

  • Minnesota National Guard cyber protection unit actively deployed
  • Executive order remains in effect until emergency conditions subside or it is rescinded
  • Ongoing federal investigation led by FBI
  • Continued assessment of compromised systems

Resident Services: For non-emergency concerns, residents can call 651-291-1111. For water emergencies, call 651-775-7231. Storm damage reports can be sent to [email protected].

Recovery Timeline: Jaime Wascalus, Saint Paul’s technology and communications director, did not provide a timeline for the restoration of city online services. City officials indicated more service updates will be shared as systems come back online.

This is a developing story. Updates will be provided as new information becomes available.

Contact Information for Residents:

  • Non-emergency concerns: 651-291-1111
  • Water emergencies: 651-775-7231
  • Storm damage: [email protected]

Last Updated: July 29, 2025 at 1:30 PM CDT