St Paul, September 3 A recent ransomware attack on Winona County, Minnesota, has highlighted the growing threat to local governments, with cybersecurity experts warning of the potential consequences of such attacks. The county paid $128,539.57 to resolve a ransomware attack earlier this year, only to suffer a second, separate attack on April 6, 2026, which disrupted critical systems and digital services. The first attack, detected in January, forced county computer networks offline and disrupted services, prompting an investigation with cybersecurity experts and the county’s insurance carrier.
After weighing the options, county officials decided to pay the sum, citing the need to ensure a full and efficient resumption of services and protect personal information, describing it in a statement as a difficult decision but ‘the necessary approach to best serve the interests of Winona County residents and employees.’ Michael Lebowitz, a former Army Cyber Command adviser and national security and cybersecurity attorney, cautioned that paying ransoms is a complicated issue, as it can signal a willingness to pay to cybercriminals, although officials must consider the need to restore critical public services.
Ransomware attacks on local governments
Cybersecurity experts have warned that attacks can cause material property damage and even affect life and limb, according to Joshua Corman, executive in residence for public safety at the Institute for Security and Technology. The attack on Winona County, which affected vital emergency and municipal services into April 7, has prompted Governor Tim Walz to issue an executive order providing emergency assistance. Lebowitz noted that artificial intelligence is making cyberattacks easier and more effective, helping criminals find vulnerabilities quicker and in bulk.
The two ransomware incidents remain open criminal investigations, with Winona County conducting a comprehensive review to determine what information was involved and planning to send notification letters to affected individuals, including complimentary credit monitoring if Social Security or driver’s license numbers were compromised. County officials have stated that the two attacks were unrelated, although Lebowitz suggested that the distinction may not be clear, as unpatched vulnerabilities could attract different ransomware groups.
Cybersecurity concerns
Cybersecurity experts are warning that the threat of ransomware attacks is not limited to local governments, with a coordinated cyberattack linked to Iran targeting more than 40 Minnesota water systems in late July, disrupting operations although no long-term damage or impact to drinking-water quality was reported. Lebowitz also cautioned that paying ransoms is complicated, noting that there is no guarantee payment will fully resolve an attack and that ‘The FBI certainly doesn’t recommend paying the ransom because then they’re known to pay.’ Looking ahead, it will be crucial to monitor the developments in the investigation into the Winona County ransomware attacks and the measures being taken to prevent similar incidents in the future, as the threat of ransomware attacks continues to grow and evolve, with potentially severe consequences for local governments and critical infrastructure.
