The files posted "appear to come largely from a single shared network drive" used by the Parks and Recreation Department, St. Paul Mayor Melvin Carter said on Monday evening.

For the second day, a steady stream of St. Paul employees streamed in and out of Roy Wilkins Auditorium, which had been quickly converted to a password reset center.

The city of St. Paul said over the coming days, around 3500 employees will begin the process of scrubbing their data in the aftermath of the city's cyberattack.