Bill payment information, like credit card numbers, is generally handled by “cloud-based” applications and should not have been affected by the hack, the mayor said.

A ransomware attack is what prompted St. Paul officials to proactively shut down the city's information systems more than two weeks ago. Mayor Melvin Carter confirmed on Sunday that the person or people behind the attack demanded a specific sum of money and threatened to release data, but the city did not pay the ransom.

For the second day, a steady stream of St. Paul employees streamed in and out of Roy Wilkins Auditorium, which had been quickly converted to a password reset center.

The files posted "appear to come largely from a single shared network drive" used by the Parks and Recreation Department, St. Paul Mayor Melvin Carter said on Monday evening.