Hackers post stolen St Paul data online as efforts to reset city employee passwords surge forward FOX 9 MinneapolisSt Paul

pShareppFOX 9s Rob Olson has the latest on the St Paul cyberattack that demanded ransomppST PAUL Minn FOX 9 For the second day a steady stream of St Paul employees streamed in and out of Roy Wilkins Auditorium which had been quickly converted to a password reset centerppEighty laptops were set up in two rows accommodating the same number of people every 30 minutesppOut of 3500 employees by late Monday theyd had more than 2000 pass through A single clearinghouse to get it done in the most secure and efficient way possibleppSo the recommendation from all the cybersecurity experts is this physical inperson reset is the most secure option to take said Mary GleighMatthews the citys Deputy Chief Information OfficerppA group that operates on the dark web accessed and published more than 46 gigabytes of city worker data in a ransomware attack that began in the citys parks and recreation department according to the latest developments provided by St Paul Mayor Melvin CarterppWhat we knowppThe city detected the hacker breach on July 25 and immediately took steps to protect themselves from further damage shutting off systems and backing up all their datappThe FBI Homeland Security and the Minnesota National Guard are all working with the city to scour the systems to bring them back onlineppThe city confirmed over the weekend that it was a ransomware attack and said they did not and will not pay the ransom ppOn Monday Mayor Melvin Carter said 43 gigabytes of data from a city Parks and Recreation shared server had been posted online after the city did not pay a ransomppBut Carter said the data released was not criticalppThese are not core city systems like payroll permitting or licensing Carter saidppThe contents are varied and unsystematic They could include everything from work documents copies of IDs submitted for HR or travel or even personal items like recipesppBut he said theres no guarantee at this point they didnt steal more data than what they have shared so farppAbout 3500 employees with the City of St Paul had to do a global password reset after a ransomware attack forced the shutdown of the citys network FOX 9s Rob Olson has the latestppWhats happening nowppOn Sunday city employees began showing up at Roy Wilkins Auditorium for scheduled passwordreset appointmentsppIn 30 minute increments 80 employees at a time are given temporary passwords then guided through the process of setting up a new oneppRather than let employees do this on their on wherever they are the centrallocation to do this was advised by cyber security experts the city has hired partially to add another layer to the security of recoveryppWe want to be extremely careful explained Mary GleichMatthews the citys Deputy Chief Information OfficerppSo were verifying the identity of our employees to make sure they are who they say they are and then we just really wanted to have that physical kind of moment to make sure that their devices were safe that they understood what was going on how we were protecting themppIf employees also have a takehome device such as a laptop that is a second step to making sure they have the updated cybersecurity software installedppThe goal is to get everyone outside of those on vacation or on leave to be updated by the end of the day Tuesday  And theyre moving very fastppWere not going to go faster than it is safe said GleichMatthews but I can say that we are making excellent progress compared to a lot of there folks that have had an experience like thisppWhats nextppIts still unclear when the citys systems will be fully back online  Some systems those which use cloudbased servers were never affected and have continued to functionppBut others such as payroll or licensing have had to revert to oldfashioned human processingppCarter said advanced security software has now been installed on more than 90 of city devices and that theyve spent the past two weeks pouring through every server and applicationppThis work will continue until we complete secured upgrades on every device and account reviewed every system and strengthened every public policy needed to protect our people and the services they deliver Carter saidppEvery city employee is offered 12 months of credit monitoring and identity theft insuranceppAll the news you need to know every dayppBy clicking Sign Up I confirmthat I have read and agreeto the Privacy Policy and Terms of ServiceppWatch local news weather and live events on Roku Fire TV and more just search FOX LOCAL ppThis material may not be published broadcast rewritten or redistributed 2025 FOX Television Stationsp