WINONA, September 2 — A Minnesota county that paid cybercriminals to recover from a ransomware attack earlier this year has been hit by a second, separate digital assault that forced emergency and municipal services offline and drew state-level emergency response. The Winona County Board of Commissioners disclosed that the county negotiated and paid a fee of $128,539.57 with assistance from its insurance carrier after detecting a ransomware attack on January 22.
The commissioners described the decision as difficult but necessary to restore vital public services and protect personal data after the incident forced several county computer networks offline and caused widespread service delays. Affected individuals received formal notification of the January breach on May 12, following a review of compromised data.
Second attack triggers state emergency response
Less than three months later, on April 7, a second and unrelated ransomware strain appeared on the county’s network. This subsequent attack significantly impaired emergency and municipal services. Systems including the Department of Motor Vehicles and vital statistics remained offline for days.
The severity prompted Minnesota Governor Tim Walz to authorize the Minnesota National Guard and the Bureau of Criminal Apprehension to assist with emergency operations and network hardening. The county is now conducting a comprehensive review of data targeted in the April attack to determine what information was accessed and who was affected.
Notification letters will be mailed to affected individuals once that review is complete. For those whose Social Security numbers or driver’s license numbers were compromised in the April incident, the county will provide complimentary credit monitoring and identity protection services.
Official response and future safeguards
The commissioners expressed gratitude for community patience throughout the disruptions. They assured citizens that aggressive measures have been and will continue to be taken to minimize the risk of similar events occurring again. The county is undertaking aggressive upgrades to its digital infrastructure to reduce the risk of future incidents.
