St. Paul cyber attack: Organization takes credit for ransomware attack on city, releases some data

City hackers identified

On Monday, St. Paul Mayor Melvin Carter provided an update regarding the ransomware attack on the city over two weeks ago.

RELATED: 3,500 St. Paul city employees begin password reset process; city confirms cyberattack was ransomware

The city is still working on fixing the cybersecurity breach, which happened on July 25 and crippled a variety of city services. It also put employees’ data at risk.

Mayor Carter would not say the name of the cyber thieves but confirmed on Monday that it’s a network called “Interlock.” The ransomware organization, which operates on the dark web, took credit for the attack on Monday.

Interlock is a “sophisticated” and “money-driven” organization, Carter said, adding that the group claimed to have stolen 43 GB of data from City of St. Paul systems.

Carter said the files that were taken mostly came from a “single, shared network drive” used by the parks and recreation department.

The information on that drive is varied, Carter said, and “could include everything from work documents, copies of IDs submitted for HR or travel or even personal items, like recipes.”

None of the affected data included information on payroll, permitting, or licensing.

Carter also said the city refused to pay the group a ransom, so they posted the information online.

Now, the city is working to rebuild its computer system to prevent Interlock and others from attempting another hack. The mayor said there has not been a second attack by Interlock, and there’s been no second ransom demand.

The head of the city’s IT department says the computer system reconstruction is not finished yet.

“Our cyber incident response team that we’ve hired is going through every single server, every single file, and then once they clear it, we take it, and then we’re going to start testing it, and so that’s what is really taking so long,” Jaime Wascalus, St. Paul Director of Technology, said.

The Minnesota National Guard and the FBI are both assisting with the cyberattack while the city remains in a state of emergency due to the incident.

Watch the full briefing from Carter and city officials below.

Related stories:

St. Paul City Council extends local state of emergency following cyberattack
Mayor Carter says city continues its response to cyberattack; no timeline for when systems will be ‘up and running’
GOP lawmakers seek answers from Mayor Carter on St. Paul cyberattack response
St. Paul Mayor Melvin Carter shares an update about cyberattack

The post St. Paul cyber attack: Organization takes credit for ransomware attack on city, releases some data first appeared on KSTP.com 5 Eyewitness News.