Ramsey County board extends local emergency after City of Saint Paul cyberattack; county systems unaffected, officials say

The Ramsey County Board of Commissioners on Aug. 5 voted to declare and extend a local state of emergency in response to a digital security incident affecting the City of Saint Paul, while county officials said Ramsey County systems have not been compromised.

County Manager Lynn Becker told the board the city detected coordinated malicious activity that prompted the city to restrict access to targeted systems and shut down its network to contain the threat. Becker said the Minnesota National Guard cybersecurity team, deployed under Governor Tim Walz’s emergency order, began assisting the city Friday and is working with city staff on system restoration.

The declaration enables Ramsey County to mobilize resources, coordinate with the city on continuity of emergency communications and public safety responses, and provide requested support. Becker said she will have authority to end the county’s local emergency when advised that it is no longer warranted; she will notify Board Chair Tera Ortega within 24 hours of that determination.

Becker said Ramsey County operates the countywide 911 center and that the center and other essential public safety services remain fully functional. “At this time, Ramsey County systems have not been compromised,” she said, thanking county staff and naming Chief Information Officer Chetan Ganatra and Chief Information Security Officer Stacy Kaiser for their work. She added that staff are coordinating with the city and municipal partners, and that some guard members may be seen in shared buildings while assisting with restoration work.

Commissioners asked about operational impacts and protocols. Ortega and Becker said the county is assessing the technical and business impacts of the city’s network shutdown on county operations — including a current inability for county staff to send or receive email to City of Saint Paul addresses — and evaluating safe reconnection steps. Becker said county IT uses endpoint protection tools such as CrowdStrike and runs ongoing scans; she offered to have the county CIO and CISO brief the board on cybersecurity safeguards and planned accelerations of pilot projects.

Commissioner questions also addressed notification protocols after incidents in smaller cities: Becker said county emergency management and the emergency communications center are coordinating outreach to municipal administrators, local police and fire leaders to strengthen shared protocols for rapid information-sharing in future incidents.

Becker noted a separate digital incident affecting North Saint Paul Police; county staff said they have communicated with relevant parties and do not currently see a need to alter county digital interactions.

Chair Ortega moved the emergency declaration; the motion passed on a roll call recorded as Aye from Commissioners McGuire, McMurtry, Miller, Jeong, Jevin Singh and Ortega (Moran excused). The declaration mirrors a 90-day extension the City of Saint Paul enacted and is intended to provide flexibility to sustain coordination and resource-sharing while the city continues forensic investigation and system restoration.

County leaders emphasized the incident underscores a continuing need for vigilance and investment in cybersecurity. Becker asked employees to follow security guidance and said the county will continue to coordinate with state and federal partners as needed.

The board left the emergency in place and authorized the county manager to terminate it once emergency management and subject-matter experts advise the risk has subsided.