How St. Paul, Minn., recovered from a ransomware attack

When ransomware struck St. Paul, Minn., last July, Chief Information Officer Jaime Wascalus turned to the city’s Emergency Management Department as IT teams began shutting down portions of the network.

The response moved beyond City Hall, with a recovery effort that included Minnesota Information Technology Services (MNIT), federal and state investigators, private-sector cybersecurity specialists, and the Minnesota National Guard. Since the attack, officials have spoken to legislators, at conferences and at symposia, sharing their story in the hopes it can help other governments improve cybersecurity preparedness and response.

Suspicious activity was first identified by the IT team at St. Paul’s water utility, Wascalus told Government Technology. The utility, which is part of the city, maintains its own technology staff and systems, while sharing one network with the local government. The utility was using endpoint detection and response technology deployed through MNIT, utilizing federal State and Local Cybersecurity Grant Program funds.

Read more at Government Technology