The IT Nerd

Ransomware group Interlock today took credit for a July cyber attack on the city of St. Paul, Minnesota. The attack prompted governor Tim Walz to activate the national guard in response. And to top that off, the city didn’t pay up.

Commenting on this news is Rebecca Moody, Head of Data Research at Comparitech: 

“While the City of St. Paul should be applauded for not meeting its hackers’ ransom demands, it was inevitable that a claim from the responsible group would quickly appear. Interlock wasted no time posting the city to its site and alleges that 43 GB has been stolen. This is made up of 66,460 files across nearly 7,900 folders with the proof pack containing various IDs and documents.”

“Now, the City of St. Paul needs to respond to confirm what data has potentially been impacted and who has been affected. In the meantime, we highly recommend residents and employees remain on high alert for any potential phishing campaigns (e.g. emails, texts, or calls reporting to be from St. Paul) and monitor their accounts for any suspicious activity.”

“As our report for July 2025 has found, ransomware attacks on government entities are of particular concern as hackers remain focused on causing mass disruption via these organizations, with critical infrastructure also being targeted. St. Paul is a prime example of this as numerous areas have been affected, including public works and payments for water services.”

I am a big believer that you should not pay these threat actors as it only encourages them to keep doing this. The new problem is that the data that Interlock stole is now out there. And that will have far reaching effects on those people who are associated with that data.

Today, Comparitech researchers released a study looking at the state of global ransomware attacks in July 2025. It was found that after three consecutive months of decline, July saw a four-percent uptick in ransomware attacks. Additionally, governments remain a key focus for hackers, with nine confirmed attacks on this sector carried out in nine different countries. 

Key findings include: 

• 464 attacks in total — 35 confirmed attacks
• Of the 35 confirmed attacks:
  • 18 were on businesses
  • 9 were on government entities
  • 3 was on healthcare companies
  • 5 were on educational institutions
• Of the 429 unconfirmed attacks:
  • 383 were on businesses
  • 12 were on government entities
  • 21 were on healthcare companies
  • 12 were on educational institutions
• The most prolific ransomware gangs were Qilin (62), INC (55), SafePay (43), Akira (37), and Play (22). INC had the most confirmed attacks (5), followed by Qilin (4), SafePay (3), and Rhysida (2)
• Where hackers provided the data theft size (in 222 cases), nearly 105 TB of data was allegedly stolen, giving an average of 476 GB per breach
• Several new gangs appeared this month, including Payouts King, Beast, and D4RK 4RMY. BlackByte also resurfaced after a 10-month hiatus

For full details, the full research can be found here: https://www.comparitech.com/news/ransomware-roundup-july-2025/