City of St Paul Listed by interlock Ransomware Group

On July 26, 2025, the City of St. Paul appeared on the leak site of the Interlock ransomware group after its internal files were allegedly exfiltrated during a ransomware attack. Residents of the Minnesota capital, along with current and former city employees and their families, now face the risk that sensitive personal information may be publicly released or sold.

What's Publicly Reported from Reporting

Public reporting indicates that Interlock posted evidence of a successful breach against the municipal government of St. Paul, Minnesota. The city has a population of approximately 310,992 and forms part of the Minneapolis-Saint Paul metropolitan area. Available details describe the theft of internal files, although the exact number of individuals affected remains unknown at this time. No specific deadline for ransom payment has been publicly confirmed in the initial postings.

The data involved consists of internal files exfiltrated during the ransomware incident. Ransomware.live has indexed the listing on Interlock’s onion site, making the claim verifiable through independent trackers that monitor extortion groups.

Why This Matters for You and Your Family

When a city government suffers a breach, the people whose records it holds are the ones left exposed. Your name, address, date of birth, Social Security number, driver’s license details, or employment records may have been stored in the very files now in attackers’ hands. Once that information reaches dark-web markets or public leak forums, it can be used for identity theft, tax fraud, or targeted scams against you or your children.

St. Paul residents and city employees did not choose this risk. Municipal systems often contain information about families who have lived in the city for decades, including school records, housing assistance files, and payroll data. A single breach can turn routine government paperwork into a lifelong privacy problem.

The Doxxing and Identity-Chain Implications

Stolen government files rarely stay isolated. Attackers combine them with credential leaks from earlier breaches to build detailed profiles. An email address found in city records can be matched to a reused password from a gaming site, a social-media handle, or a family member’s account. This creates an identity chain that leads directly to you and your household.

Credential leaks like this one frequently cascade into account takeovers. Gaming accounts belonging to you or your children are especially vulnerable because they often share the same passwords or recovery emails used for government services. Once attackers control those accounts, they can harvest additional personal details, photographs, and contact lists that expand the doxxing chain even further.

Interlock Ransomware Group Track Record

Public reporting attributes the attack to the Interlock ransomware group. The group emerged in late 2024 and has targeted organizations across multiple sectors since then. Notable prior victims include other municipal governments and mid-sized enterprises whose data appeared on the same leak site. Their typical playbook involves initial access through compromised credentials or unpatched remote desktop services, followed by exfiltration of sensitive files and extortion demands that combine ransom payments with threats of public data release.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate any password you used for St. Paul city services or portals anywhere else it appears, and switch to 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing your own accounts.

The St. Paul breach is a reminder that government systems holding your data can fail without warning. Taking concrete steps now limits how far attackers can travel down the identity chain that begins with this incident. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to regain control over what attackers already hold.