Winona County, Minnesota, has begun notifying residents that attackers copied a wide range of sensitive records during a ransomware intrusion this spring. The stolen data includes Social Security numbers, fingerprints and DNA reports related to paternity testing. The county posted a Notice of Data Security Incident on its website and began mailing letters on October 8, 2026. The intrusion, detected April 7, was the county's second ransomware attack of the year. The first, detected January 22, ended with the county paying $128,539.57.

What happened

According to the county's notice, it detected ransomware on its network on April 7, 2026. Cyber criminals had accessed the network between March 13 and April 7, a span of 25 days, and copied county data during that time. The county says it notified federal law enforcement and appropriate state agencies.

The attack disrupted public services. In a statement released April 8, the county said it had taken its systems offline "out of an abundance of caution," and MPR News reported that the public should expect delays. The county declared a local state of emergency, notified the FBI and brought in outside cybersecurity and forensics consultants, MPR reported. 911, fire and emergency resources were not interrupted. KTTC later reported that systems including the DMV and vital statistics stayed offline for days.

Gov. Tim Walz authorized the Minnesota National Guard to help. The governor's office said the county requested support "due to the scale and complexity of the incident," according to MPR News, and Walz said, "Swift coordination between state and local experts matters in these moments." KTTC reported in August that the state Bureau of Criminal Apprehension also assisted with emergency operations and network hardening.

Who and what is affected

The notice lists these categories of exposed information. Not every category applies to every person:

  • Names, addresses and dates of birth
  • Social Security numbers
  • Driver's license and state ID numbers
  • Financial account and credit/debit card information
  • Medical and health insurance information
  • Information contained in law enforcement reports
  • Immigration identification numbers, passport numbers and Individual Taxpayer Identification Numbers (ITINs)
  • Fingerprints and DNA reports related to paternity testing
  • Military service numbers and veteran identification numbers
  • Usernames and passwords for non-financial accounts

KTTC reported on October 12 that the county is offering free credit monitoring to people whose Social Security number or driver's license was stolen. The notice itself points residents to free credit reports, fraud alerts and security freezes. It says the county has deployed security tools to improve detection and speed up response, is monitoring its network with endpoint detection tools, and is conducting an enterprise-wide password reset. A call center is available at 1-866-200-0895, 8 a.m. to 8 p.m. Central, Monday through Friday, excluding major holidays.

The January attack and the payment

The earlier attack was detected on January 22, 2026, and took several county networks offline, KTTC reported. In a statement reported by KTTC on August 31, the county commissioners said: "Winona County negotiated and paid a fee [of $128,539.57] with assistance from our insurance carrier." The commissioners said "we determined it was the necessary approach to best serve the interests of Winona County residents and employees." People affected by the January incident were notified on May 12, 2026.

The county describes the two incidents as unrelated. KTTC reported on August 31 that county officials emphasized the April incident, which it described as a second ransomware strain, was entirely separate and unrelated to the January incident. County Administrator Maureen Holte said on April 8, MPR News reported, that a preliminary investigation indicated the cybercriminal behind the April attack was not the one responsible for the January attack. She added that improvements made after the first attack helped the county detect and respond to the second.

What is known and what is not

  • Ransom for the April attack: Neither the county's notice nor the KTTC and MPR reports say whether a ransom was paid for the second incident.
  • Number of people affected: No count appears in the county's notice or in the cited reports.
  • Who was behind it: The county has not publicly named the attackers in either incident. It has said only that, based on a preliminary investigation, a different criminal was behind the April attack.
  • How the attackers got in: The notice gives the dates of access but does not describe the initial entry point.

What It Means for Defenders

  • Residents who get a letter: Enroll in the credit monitoring if eligible, and verify any contact about the incident through the call center number on the county's own notice page before acting on it.
  • Change reused passwords: Change any password used on a county account that is also used elsewhere, and turn on multi-factor authentication where available.
  • Lock down credit and watch for targeted fraud: Place a free fraud alert or security freeze with the credit bureaus, review account statements, and treat unsolicited messages that cite passport, ITIN, military or medical details with suspicion.
  • Local governments: Confirm endpoint detection covers every workstation and server and that alerts reach someone who will act on them around the clock; the dwell time described above is the window to close.
  • After any incident: Reset credentials enterprise-wide and hunt for leftover access before declaring recovery, and plan for a second, unrelated attacker.

Sources