Penetration Testing in Minneapolis, MN
Minneapolis and Saint Paul host more Fortune 500 headquarters per capita than almost any US metro, and an unusual share of them hold the data of ordinary Americans: Target, U.S. Bancorp, Ameriprise, Xcel Energy and Thrivent downtown, Best Buy in Richfield, UnitedHealth Group and Optum in Eden Prairie and Minnetonka, Medtronic's operational headquarters in Fridley, Boston Scientific in Maple Grove, Cargill in Wayzata, General Mills in Golden Valley, Land O'Lakes in Arden Hills, and 3M and Ecolab across the river in Saint Paul. Around them sit Allina Health, M Health Fairview, Children's Minnesota and HealthPartners, the University of Minnesota, and the Mayo Clinic ninety minutes south in Rochester. HackersHub runs offensive security engagements scoped to the threat model these organisations actually face: supply-chain compromise of retail and payment systems, ransomware against clearing houses and clinical networks, state-aligned collection against medical-device and agricultural IP, and the Minnesota Consumer Data Privacy Act, HIPAA, FDA section 524B, PCI DSS v4.0.1, FFIEC and SOC 2 evidence that regulators, auditors and institutional customers now expect.
The Minneapolis and Minnesota threat landscape
Two of the most consequential breaches in US corporate history were run against Minneapolis-area companies, and both were supply-chain attacks. In November and December 2013 attackers used credentials issued to a heating and ventilation contractor to move from Target's vendor portal to its point-of-sale network and extract roughly 40 million payment-card records, the incident that pushed US retail onto EMV and made third-party access the first question in every PCI assessment. In February 2024 the ransomware attack on Change Healthcare, the UnitedHealth Group clearing-house subsidiary, halted claims, prescriptions and payments for providers across the country for weeks and, by the company's January 2025 estimate, exposed the data of around 190 million people, the largest breach ever reported at a HIPAA-regulated entity; the intrusion began with a remote-access portal that lacked multi-factor authentication. The public sector has not been spared: Minneapolis Public Schools was hit in February 2023 and the attackers published files on more than 105,000 people when the district declined to pay. The medical-device cluster from Fridley to Maple Grove now operates under section 524B of the Federal Food, Drug, and Cosmetic Act, which since March 2023 requires premarket submissions for cyber devices to include a software bill of materials, a vulnerability-management plan and evidence of security testing. The agriculture and food companies of the western suburbs run commodity-trading, plant-control and logistics systems that federal agencies have named a critical-infrastructure sector in their own right. Minnesota's regulatory response arrived on 31 July 2025, when the Minnesota Consumer Data Privacy Act (Minn. Stat. chapter 325O) took effect: it requires controllers to maintain a data inventory, to document data security practices, to run data protection assessments for high-risk processing, and it gives the Attorney General civil penalties of up to 7,500 dollars per violation once the cure period lapses at the end of January 2026. It sits on top of the breach statute (Minn. Stat. 325E.61), which requires notification of affected residents in the most expedient time possible and of the national consumer reporting agencies within 48 hours when more than 500 people are notified, and the Minnesota insurance data security law (Minn. Stat. 60A.985 to 60A.9858), which has required insurers and producers to run a written information security program since 1 August 2022. Engagements in the Twin Cities routinely uncover vendor and franchisee remote access that bypasses the corporate identity provider, store and distribution-centre networks that still trust each other, device-update servers protected by shared credentials, claims and provider portals with authorisation flaws across the member-provider-payer boundary, and data inventories that omit the analytics and marketing copies where personal data actually accumulates.
Need a penetration test in Minneapolis?
Written scope, named OSCP-certified testers, report within a week of the last testing day.
Industries we routinely engage in Minneapolis
Repeatable threat patterns by sector, drawn from engagement data rather than vendor marketing.
Retail, e-commerce & consumer brands
National retailers headquartered downtown and in Richfield, their e-commerce platforms, loyalty programmes, store and distribution-centre networks, and the consumer brands and franchise systems of the western suburbs. Manual web-application and API pentests of storefront, loyalty and fulfilment platforms, point-of-sale and store-network segmentation testing, vendor and franchisee remote-access review, and red team operations scoped against supply-chain tradecraft. Evidence mapped to PCI DSS v4.0.1 Requirement 11.4, the Minnesota Consumer Data Privacy Act and SOC 2. Our PCI DSS penetration testing guide at /insights/pci-dss-penetration-testing/ covers segmentation testing and cadence.
Health insurance, payers & health-tech
The national payer and health-services campuses of Eden Prairie and Minnetonka, regional health plans, pharmacy-benefit and claims-processing platforms and the health-tech vendors that connect them. Manual testing of member, provider and broker portals, API assessments across the payer-provider boundary, cloud and identity reviews of claims and clearing-house environments, and assumed-breach testing of the corporate domain. HIPAA Security Rule evaluation evidence (45 CFR 164.308(a)(8)), Minnesota insurance data security law mapping and SOC 2. Our HIPAA penetration testing guide at /insights/hipaa-penetration-testing/ covers scope and cadence.
Medical devices & connected health
Device manufacturers from Fridley to Maple Grove and Arden Hills, the digital-health and remote-monitoring companies around them, and their contract manufacturers. Device, firmware, companion-app, cloud back-end and update-mechanism testing in support of FDA section 524B premarket submissions and the FDA premarket cybersecurity guidance, threat modelling and SBOM-driven vulnerability review, and post-market testing after significant changes. Reporting aligned to 21 CFR Part 11 and ISO 14971 risk-management files.
Hospital systems & academic medicine
Multi-hospital systems across the metro, children's and specialty hospitals, the academic medical centre on the University of Minnesota campus, and the clinic networks that extend into greater Minnesota. HIPAA Security Rule evaluation evidence, clinical-network and medical-device segmentation review, identity-led methodology across hospital, university and physician-practice directories, and breach-readiness mapped to Minn. Stat. 325E.61 and the HIPAA Breach Notification Rule.
Agriculture, food & commodities
Agribusiness and food-ingredient headquarters in Wayzata, Golden Valley and Arden Hills, grain and protein processors across greater Minnesota, cooperative networks and the commodity-trading desks that serve them. Corporate-network and identity assessments, plant-floor and OT boundary testing under IEC 62443, trading-system and partner EDI assessments, and SOC 2 or customer-driven evidence for the food supply chains these companies anchor. Reporting aligned to CISA Cross-Sector Cybersecurity Performance Goals and the food and agriculture sector-specific guidance.
Banking, asset management & insurance
National and regional banks headquartered downtown, financial-planning and asset-management firms, fraternal and life insurers, and the credit unions and community banks of the metro. External and internal penetration tests, identity and privileged-access assessments, manual web-application and API pentests of digital-banking and advisor platforms, and BEC-resilience phishing simulation. Evidence mapped to the FFIEC IT Examination Handbook, the amended GLBA Safeguards Rule, OCC expectations, the Minnesota insurance data security law and SOC 2. Our GLBA and FFIEC penetration testing guide at /insights/glba-ffiec-penetration-testing/ sets out what examiners look for.
Compliance frameworks we report against
Engagements for Minneapolis-based organisations regularly feed into Minnesota, federal and customer-driven regulatory reporting. Deliverables include a penetration testing statement, executive summary, technical report with proof-of-concept, and a remediation tracker, formatted to satisfy the evidence requirements of each framework below without additional documentation.
- Minnesota Consumer Data Privacy Act (Minn. Stat. chapter 325O), in force since 31 July 2025: data inventory, documented data security practices, data protection assessments for high-risk processing, Attorney General enforcement with civil penalties of up to 7,500 dollars per violation
- Minn. Stat. 325E.61 breach notification: affected residents in the most expedient time possible and without unreasonable delay; national consumer reporting agencies within 48 hours when more than 500 people are notified
- Minn. Stat. 13.055 breach notification duties for state and local government entities
- Minnesota insurance data security law (Minn. Stat. 60A.985 to 60A.9858): written information security program required since 1 August 2022, risk assessment, incident investigation and notification to the Commissioner of Commerce
- HIPAA Security Rule 45 CFR 164.308(a)(8) technical evaluation and the HIPAA Breach Notification Rule
- FDA section 524B of the Federal Food, Drug, and Cosmetic Act (in force since 29 March 2023) and the FDA premarket cybersecurity guidance for cyber devices
- 21 CFR Part 11 electronic records and ISO 14971 risk management for medical-device manufacturers
- PCI DSS v4.0.1 Requirement 11.4 penetration testing and segmentation testing for retail and payment environments
- FFIEC IT Examination Handbook and GLBA Safeguards Rule (16 CFR Part 314, amended 2023)
- NERC CIP-005 / CIP-007 / CIP-010 for bulk electric system entities in the MISO footprint
- IEC 62443-3-3 for industrial control systems in food processing and manufacturing
- SOC 2 Trust Services Criteria CC7.1 / CC7.4
- NIST CSF 2.0 and NIST SP 800-115 technical security testing
Services delivered for Minneapolis engagements
Same global service catalogue, scoped to the Minnesota regulatory and operational context.
See also:Penetration Testing in ChicagoPenetration Testing in IllinoisPenetration Testing in Denver
Why Minneapolis organisations choose HackersHub
HackersHub is an Amsterdam-headquartered practitioner firm with no US office, and we model Minneapolis engagements honestly around that. External, web-application, API, cloud, identity and device-firmware testing is delivered remotely from the Netherlands, with devices shipped to our Amsterdam lab where the scope calls for it; internal network, Active Directory, wireless, store and plant-floor, OT and physical assessments are delivered on site in downtown Minneapolis, Saint Paul, Eden Prairie, Fridley, Maple Grove and the western suburbs by travelling testers. Scoping calls, status updates and report walkthroughs are scheduled on US Central business hours. Every engagement is led by named OSCP-, OSWE- or CREST-certified offensive security professionals, with Michael van Mameren (OSCP) acting as engagement lead, and reports are written directly against the Minnesota Consumer Data Privacy Act, HIPAA, FDA section 524B, PCI DSS v4.0.1, FFIEC and SOC 2 evidence categories. For retail and clinical environments, testing follows the client's change-freeze calendar, including the holiday trading freeze. Senior-level scoping calls happen within one business day.
Frequently asked questions: Minneapolis
Ready to Secure Your Systems?
Request a quote for your penetration testing needs.