During the Sept. 4 address, Carter proposed allocating the money to cybersecurity in two forms: a $700,000 one-time reserve in the city’s central account, and $381,000 in ongoing support embedded in the tech department’s operating budget. To make room, he proposed that the city eliminate a vacant human resources consultant position, reduce a support contract and add a service automation software platform.
Despite the newly announced cybersecurity investment, the Office of Technology and Communications is still proposed to receive a below-average share of new general fund spending of $15 million. The department’s budget would grow by 2.7 percent, compared to a 3.7 percent increase citywide.
Departments such as Planning and Economic Development, Emergency Management and Police see much steeper proposed increases, consistent with Carter's goals for housing, revitalization and public safety.
The data visualization below shows which departments would see the biggest year-over-year budget changes under the mayor’s 2026 proposal.
St. Paul refused to pay the ransom, and the group behind the attack published 43 gigabytes of city data online several days after city staff announced the breach. City officials argued the relatively small scope of the leak illustrated that the attackers were not able to access sensitive data from core city systems. As recovery efforts continue, the majority of city systems are now operational.
Carter called the city’s response a success, praising “the power of early investment and having the right people at the right time,” that allowed uninterrupted delivery of core services like 911 response, as well as maintaining payroll systems.
An excerpt of Carter’s remarks from his speech, posted to the city’s YouTube channel, can be viewed in the video below.
“This budget invests a million dollars to finish the job, restoring systems with stronger safeguards, expanding proactive cybersecurity defendants, defenses, doubling down on secure, transparent service delivery and acting to protect the employees who may have had data released in that breach,” he said.
Carter promised to provide a year of identity theft protection and cybersecurity monitoring for every city employee following the attack.
On Aug. 27, Carter and city IT employees and emergency management staff shared an update about the attack to the Minnesota Legislative Commission on Cybersecurity, detailing the steps involved in what became called “Operation Secure St. Paul.”
During the commission meeting, the mayor explained that the city transformed Roy Wilkins Auditorium, a 5,000-seat venue that houses events such as roller derby games and K-pop conventions, into a “secure operations hub.” City staff were not able to access their devices until they visited the venue to verify their identity and be issued temporary passwords.
“I think all city employees in this room will vouch that they came through that process with the absolute longest password that they’ve ever had,” Carter said during his budget proposal announcement.
