{"id":2330,"date":"2025-08-17T07:52:17","date_gmt":"2025-08-17T07:52:17","guid":{"rendered":"https:\/\/ft365.org\/index.php\/2025\/08\/17\/st-pauls-mayor-confirms-interlock-data-leak\/"},"modified":"2025-08-17T07:52:17","modified_gmt":"2025-08-17T07:52:17","slug":"st-pauls-mayor-confirms-interlock-data-leak","status":"publish","type":"post","link":"https:\/\/ft365.org\/index.php\/2025\/08\/17\/st-pauls-mayor-confirms-interlock-data-leak\/","title":{"rendered":"St. Paul\u2019s Mayor Confirms Interlock Data Leak"},"content":{"rendered":"
\n

\"Photo<\/p>\n<\/div>\n

\n
\n

Officials from the City of St. Paul, Minnesota, have confirmed that the Interlock ransomware group has published employee data online after refusing the attackers\u2019 payment demands.<\/p>\n

Mayor Melvin Carter said that the gang appeared to have published approximately 43GB of data stolen from St. Paul City Council systems.<\/p>\n

\u201cThe files they posted appear to come from a single shared network drive used by our Parks and Recreation department, a place where individual employees have stored their own personal files over time,\u201d Carter commented during a press conference on August 11.<\/p>\n

\u201cThese are not core city systems like payroll, permitting or licensing. The contents are varied and unsystematic. They could include everything from work documents, copies of IDs submitted for HR for travel, or even personal items like recipes,\u201d he continued.<\/p>\n

The City is offering 12 months of credit monitoring and identity theft to all its employees.<\/p>\n

The press conference took place shortly after cybersecurity threat analysts observed the Interlock group update its data leak site with information it purportedly stole from City of St. Paul systems, including personal details of employees and residents.<\/p>\n

\u201cA large part of the infrastructure was damaged, brought a lot of losses and damage,\u201d the group wrote in its post containing the stolen data.<\/p>\n<\/p><\/div>\n

\n
\n

Interlock Ransomware Group Allegedly Breaches City of St. Paul – Leaking 43 GB of Data https:\/\/t.co\/eguEReA6Ju pic.twitter.com\/TOvU3MoGyR<\/p>\n

\u2014 Dark Web Intelligence (@DailyDarkWeb) August 12, 2025<\/p><\/blockquote>\n<\/figure>\n

\n

Mayor Provides Insights into Ransomware Negotiations<\/strong><\/h2>\n

Carter revealed that the City had engaged in communications with Interlock. He said the group ended negotiations after officials requested evidence for their claims about the data exfiltrated.<\/p>\n

\u201cWe asked them to demonstrate what they had and instead of demonstrating what they had they decided to end the conversation, which was an indication to us that they may not have thought they had much by way of value,\u201d Carter said.<\/p>\n

\u201cThat assessment is consistent with the fact that instead of trying to sell the data, they released it for free,\u201d he added.<\/p>\n

Carter noted that all of St. Paul\u2019s data was backed up, allowing the authority to maintain full control of its systems and access to all its data.<\/p>\n

These factors, in addition to advice from the FBI and Minnesota National Guard, led to the decision not to pay Interlock\u2019s ransomware demand.<\/p>\n

Carter noted that the City of St. Paul hosts approximately 153TB of data on its servers, meaning the 43GB released by the attackers is a tiny fraction of the overall volume.<\/p>\n

City Services Continue to be Disrupted <\/strong><\/h2>\n

After the incident was detected on July 25, the City initiated a full network shutdown to contain the threat.<\/p>\n

This was just three days after US government agencies issued an advisory about the activities of the Interlock gang, including its novel initial access techniques.<\/p>\n

The network shutdown has significantly disrupted local services for St. Paul\u2019s approximately 307,000 residents, including online payments for services such as garbage collection, regional water services and other public works.<\/p>\n

St. Paul residents have also been told to contact the authority via email for all non-emergencies while it continues to restore communication platforms.<\/p>\n

Mission critical operations, including emergency response and public safety services, remain fully operational, and Carter emphasized that keeping these services functioning remains the priority amid the ongoing incident response.<\/p>\n

On July 29, Carter declared a state of emergency in response to the incident, allowing the City\u2019s departments of Emergency Management and Office of Technology and Communications (OTC) to mobilize support from local, state and federal partners.<\/p>\n

Carter also provided an update on new security measures implemented as it looks to securely its digital infrastructure:<\/p>\n