Winona County administrator Maureen Holte says her staff went back to pen and paper. Twice this year, ransomware forced the Minnesota county to pause parts of its work, and residents had to deal with the courthouse the old-fashioned way.
The first attack came in January. The county negotiated and paid about $128,000, a figure the board put at $128,539.57, with help from its insurance carrier. Holte said it followed “careful consideration and also guidance from our cybersecurity team.” About $50,000 was covered by insurance and roughly $78,000 came from county levy money. Emergency services were never paused, she said.
Commissioners called paying “a difficult choice”. Their reasoning: it was “the necessary approach to best serve the interests of Winona County residents and employees,” and it would let services resume and protect personal information. People whose data was taken in January were told a few months later, once a review was finished.
Hit again in April
Different criminals struck in April. The county identified a second, unrelated attack that impaired emergency and municipal services. Governor Tim Walz mobilized the Minnesota National Guard’s cyber protection team “due to the scale and complexity of the incident.”
That review is still going. Holte said it is not yet clear how many people were affected. Letters will go out by mail once it ends, and anyone whose Social Security or driver’s license number was exposed will get free credit monitoring and identity protection. The January case remains an open criminal investigation.
“Winona County remains committed to strengthening our systems to ensure that our cyber defenses are the best that they can be, so that we don’t have future incidents,” Holte said. The board thanked the community for its patience.
Why local governments
Minnesota’s chief information officer, John Israel, said state and local governments make attractive targets because their systems connect to outside partners and contractors, and they are built to be open to the public. “Governments have got to be right 100 percent of the time, whereas bad actors really have to just be right one time,” he said.
Israel described a shift. As more organizations back up their systems properly, attackers now steal data first and threaten to publish it. “We call it kind of a double extortion event,” he said. The people behind these attacks are mostly financially motivated and rarely local, often overseas groups that run extortion as a business.
The state’s 2025 Cybersecurity Incident Report found 269 public entities and government contractors in Minnesota reported possible incidents last year. St. Paul needed National Guard help last summer after a large ransomware attack that shut parts of its network. In late July, more than 30 municipal water systems in the state were targeted, and investigators later said they believed Iran was behind it.
Sources
- Winona County paid $128K ransom after cyberattack; then was attacked again
- Winona County pays $128K ransom after January cyberattack
