Winona County, Minnesota, paid $128,539.57 to deal with a ransomware attack in January. Three months later, on April 6, a second one hit.
The county says the two attacks were separate and unrelated. Cybersecurity experts told ABC 6 News the pattern is part of a growing threat to local governments.
The first attack, spotted in January, knocked county computer networks offline and disrupted services. After investigating with cybersecurity experts and its insurance carrier, the county paid. Officials said the money was meant to bring services back fully and efficiently and to protect personal information. They called it a difficult decision but “the necessary approach to best serve the interests of Winona County residents and employees.”
The second attack reached into April 7. According to the governor’s office, it disrupted critical systems and digital services and significantly impaired the county’s ability to deliver vital emergency and municipal services. Gov. Tim Walz issued an executive order providing emergency assistance.
Is it really unrelated?
Michael Lebowitz, a former Army Cyber Command adviser who is now a national security and cybersecurity attorney, is not so sure the line is clean. If a county has a hole and never patches it properly, he said, “another ransomware group might have just found a different vulnerability and then targeted it.” He added: “It’s a very murky world with these ransomware groups. I wouldn’t be surprised if there’s some, you know, some level of conversation and knowledge that this was paid.”
On the payment itself, he was blunt. “The FBI certainly doesn’t recommend paying the ransom because then they’re known to pay.” A ransom does not guarantee the attack is fully resolved, he said, and paying can tell criminals that an organization is willing and able to pay. Officials still have to weigh that against the need to restore public services and protect sensitive data.
Wider pressure
“A ransomware attack is truly a vicious type of attack,” Lebowitz said. “The impacts can be catastrophic.” Joshua Corman, executive in residence for public safety at the Institute for Security and Technology, said these attacks are not only about money. “You might think this is just a financial shakedown, but you might be doing material property damage and even affecting life and limb and loss of life,” he said.
In late July, a coordinated cyberattack linked to Iran targeted more than 40 Minnesota water systems and disrupted operations in several communities. Officials reported no long-term damage and no effect on drinking-water quality.
Lebowitz also pointed to artificial intelligence. “When they’re using AI, that’s really helping them exploit the vulnerabilities,” he said, adding that criminals find those weaknesses faster and in bulk.
Both Winona County incidents remain open criminal investigations. The county is reviewing what information was involved and who was affected, and will send letters once that is done. Anyone whose Social Security or driver’s license number was exposed will get complimentary credit monitoring and related services with theirs.
