City of St Paul targeted by Interlock ransomware group

• Ransomware group: Interlock
• Country: United States
• Sector: Government & Defense
• Announcement date: August 11, 2025

Interlock ransomware group claims data breach at City of St Paul

The Interlock ransomware group has listed approximately 42.9 GB of data on their leak site, claiming the information belongs to the City of St Paul. This announcement, made on August 11, 2025, suggests a significant breach targeting the local government entity.

Details of the alleged attack

According to the announcement published by the Interlock group, the organization was targeted on August 11, 2025. The group alleges that the city's infrastructure has sustained damage as a result of the attack. Furthermore, the group claims that residents' data has been compromised during the incident. While the group has made these claims, public information regarding the specific methods or identity of the Interlock group remains limited.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms, a tactic frequently associated with double extortion. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also exfiltrate sensitive data, threatening to release it publicly if their demands are not met. This approach increases the pressure on the victim by threatening reputational damage and legal consequences.

Data involved in the leak

The group provided a screenshot as evidence of the breach, which displays specific directory structures. The data is reportedly divided into two main folders: 'pkusers', which is approximately 40.8 GB, and 'Smithama', which is approximately 2.1 GB. While the exact nature of the files has not been explicitly detailed, the folder names suggest the potential presence of administrative records or user data. The affected data types allegedly include:

• User data (alleged)
• Administrative records (alleged)

No information was provided regarding the specific ransom demand or the exact file count within these directories.

About the City of St Paul

The City of St Paul is the local government entity of Saint Paul, Minnesota. It is responsible for managing the city's administrative affairs, public services, and infrastructure.

Potential impact and security considerations

The alleged leak poses a significant risk of exposure for the personal data of residents and employees of the City of St Paul. Under federal regulations and US state laws, a data breach of this nature could lead to various legal obligations for the institution. The exposed information might be exploited by malicious actors for targeted phishing campaigns or identity theft.

Furthermore, the alleged damage to the city's infrastructure could lead to negative impacts on operational continuity. When critical infrastructure is targeted, it can disrupt the essential services that a local government provides to its community. In the wake of such incidents, organizations typically face the necessity of verifying the leaked data and notifying all affected individuals.

To defend against such threats, organizations in the government and defense sector often implement various defensive measures. These include maintaining robust backup systems to ensure operational continuity, implementing strict access controls to protect sensitive administrative records, and conducting regular security training to prevent successful phishing attempts. Continuous monitoring of network traffic can also help in detecting unauthorized data exfiltration before large volumes of data are compromised.