Cyber Incident Victim: Minnesota Senate
Date:
Jun 2020
Location:
United States of America
Summary
A cyberattack compromised the Minnesota Senate's servers, enabling unauthorized access to a file containing passwords used by senators and staff. The breach prompted immediate shutdowns of the Senate website and WiFi network to facilitate password resets and security reviews. Senate Information Services, assisted by the state's IT agency and the FBI, confirmed the intrusion lasted several minutes and involved exfiltration of credential data. While officials noted unrelated distributed denial-of-service attacks affecting state systems, this incident specifically involved internal system access. Recovery efforts included rebuilding web pages and conducting log analyses to ensure no persistent threats remained.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On June 2, 2020, at 4:24 AM, unauthorized actors breached the Minnesota State Senate's servers, gaining access for several minutes before detection. Senate Information Services (SIS) immediately took the server offline as a precautionary measure upon discovering the intrusion. Forensic analysis conducted with assistance from Minnesota IT Services (MNIT) and the FBI confirmed the attackers had accessed a critical Passwords File containing credentials used by senators, staff, and administrative systems. This file included passwords for the Senate's main database server and WiFi network credentials. By 6:00 PM that evening, multiple Senate web pages remained offline as SIS worked to rebuild affected systems following the takedown. All compromised passwords were reset, including those for database access and WiFi authentication. The Senate WiFi network was temporarily disabled to facilitate credential resets and security testing. Log files were scrutinized to verify no persistent unauthorized access remained.
The incident caused significant operational disruption, with the Senate website partially inoperable throughout the day due to the deliberate server shutdown. Officials publicly distinguished this breach from unrelated distributed denial-of-service (DDoS) attacks targeting other state systems that weekend, noting the DDoS incidents caused only intermittent outages without compromising internal systems. Secretary of the Senate Cal Ludeman notified legislators and staff about the breach via letter on June 2, detailing the compromised assets and countermeasures implemented. No evidence suggested exfiltration of data beyond the password file, though the brief access window limited investigators' ability to determine full attacker intent. The coordinated response involving SIS, MNIT, and federal authorities focused on credential invalidation and infrastructure restoration while preserving forensic evidence for ongoing analysis.