We’ve finally learned how much money last year’s cyber attack cost the City of St. Paul.
After repeated questions to city leaders with no response, KSTP filed a public records request and finally got an answer: $2.5 million.
The City of St. Paul says it is dealing with unplanned response costs after the breach and that the total reflects costs associated with overtime, consulting support and equipment purchases.
Services made up the largest portion, totaling more than $2 million.
“That’s a lot of money,” said Jonathan Wrolstad, a U of M cybersecurity professor.
“It is expensive to have your data breach, your organization compromised, because you need to pay a lot of really highly skilled professionals for their time and effort and travel to come in and fix your problems and get your organization and its computer network up and running again,” Wrolstad said.
5 EYEWITNESS NEWS asked the city for an interview, it was set up, and then they sent a statement that said, in part, that more than 90 percent of its systems are restored and core services are running normally.
Officials explained they’re replacing older legacy systems with more modern technology that includes stronger cybersecurity protections.
City leaders added they’re in the final stages of a comprehensive after-action report conducted by cybersecurity experts, which will outline a detailed improvement plan.
When asked if the city would have paid less if they had insurance, Wrolstad said, “It can be hard to obtain. In certain cases, you have to prove to the insurance company that you have certain standards of security in place. It also is very expensive right now.”
5 EYEWITNESS NEWS reporter Brittney Ermon asked Wrolstad if it is worth the risk:
“I think hindsight is always 2020. In this case, it probably would have been worth it to have a lot of insurance coverage.”
KSTP also asked the city whether it has purchased cyber insurance since the breach, but has not heard back yet.
City officials said they canceled the scheduled interview because they want to wait until their data analysis is complete, which they expect to wrap up within the next month.
