- The National Guard has been called to help recovery from cyberattack
- An intrusion was detected in Minnesota systems in St Paul
- Networks have been shut down to isolate and protect systems
Following suspicious activity being detected in the computer networks of the capital St Paul, Minnesota Governor Tim Walz has activated the state’s National Guard to help defend against attackers.
The attack led to local officials shutting down the information systems in St Paul as a defensive measure, including network access for a range of internal applications, in order to contain the threat. Mayor Melvin Carter assured residents 911 services were operating as normal, but shared that the city has experienced some ‘back-end’ challenges;
“We recognize that these outages have created inconveniences for residents and city staff alike. While these disruptions are difficult, they are necessary steps to limit exposure, preserve system integrity, and protect sensitive information as our investigation and recovery efforts continue,” Carter continued.
A deliberate effort
The city has been working with Minnesota Information Technology Services as well as an external cybersecurity vendor, but even still the ‘scale and complexity’ of the attack has exceeded ‘both internal and commercial response capabilities’, former Democratic VP candidate Walz explained.
It’s not yet clear if this was a ransomware attack, but a range of networks and services have been intentionally and proactively shut down in order to ‘isolate and secure’ Minnesota systems.
These are ‘necessary steps to limit exposure, preserve system integrity and protect sensitive information’ argues Carter, who reveals that the breach was intentionally caused by a ‘criminal, external threat actor’.
“This was not a system glitch or technical error. This was a deliberate, coordinated digital attack carried out by a sophisticated external actor intentionally and criminally targeting our city’s information infrastructure,” Carter explained.
Critical infrastructure is a top target for cybercriminals, who leverage the importance of the services they provide and the sensitive data they hold to request higher ransoms.
The US government recently warned Medusa ransomware has hit hundreds of critical infrastructure targets in similar incidents – although no threat actor has yet taken responsibility for this attack.
