North St. Paul Police Department

Summary

The North St. Paul Police Department experienced a cyberattack prompting an emergency city council meeting to address the potentially ongoing cybersecurity incident. Council members swiftly approved a contract with law firm McDonald Hopkins to investigate the attack's full scope, though specific details about the breach remain undisclosed. This incident occurred shortly after a separate cyberattack targeting neighboring St. Paul, though authorities have not established any connection between the two events.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On August 1, 2025, the North St. Paul City Council convened an emergency meeting following the discovery of a cyberattack targeting the North St. Paul Police Department. The meeting, which lasted less than five minutes with minimal discussion, focused on addressing what officials described as "a potentially ongoing cybersecurity concern." During this session, council members approved a contract with the law firm McDonald Hopkins to investigate the incident and determine its full scope. The expedited approval process indicated the urgency with which city leadership approached the breach, though no specific technical details about the attack vector, compromised systems, or data exposure were disclosed during the public proceedings. City representatives did not confirm whether operational police systems were affected or if emergency response capabilities remained functional. The timing of the incident occurred approximately one week after the neighboring city of St. Paul disclosed its own cybersecurity incident, though authorities emphasized no connection between the two events had been established.

The cyberattack prompted immediate organizational responses but left several critical questions unanswered regarding its operational impact. While the engagement of McDonald Hopkins suggested potential legal and forensic complexities, the city provided no timeline for the investigation's completion or public disclosure of findings. No ransomware claims, data theft evidence, or perpetrator identification appeared in official statements. The absence of service disruption announcements implied core police functions might have continued, but the city did not confirm whether manual procedures were implemented as contingency measures. This incident marked the second cybersecurity event affecting a Twin Cities metro area police agency within a week, though the lack of confirmed linkages between the North St. Paul and St. Paul incidents prevented regional pattern analysis. The city maintained its focus on containment and assessment through the contracted legal team without speculating about attack origins or potential long-term consequences for departmental operations.

Sources

Sources available to members: 1 source.