Winona County officials confirmed this week that the county paid $128,539.57 to resolve a ransomware attack discovered on January 22. The disclosure comes months after the initial breach, and it lands amid a broader pattern of local governments across the country facing costly ransomware demands that strain public budgets and expose residents’ personal data.
The payment was made with assistance from the county’s insurance carrier, according to commissioners, who said the goal was to fully restore county services and protect personal information tied to the network. County officials also revealed a second, unrelated ransomware incident detected on April 7, meaning Winona County has now dealt with two separate cyberattacks within a span of less than three months.
Winona County is still reviewing what data was compromised in the April incident, and the outcome of that review will determine how many residents are notified and what protections they receive. The county’s handling of both cases, including the decision to negotiate payment in the first, is likely to draw scrutiny as officials continue assessing the fallout and shoring up their defenses against future ransomware attempts.
Timeline of the January Ransomware Attack
Winona County said it first detected ransomware on its computer network on January 22. The county responded by opening an investigation that involved third-party forensic experts alongside federal law enforcement, a standard early step for local governments dealing with a suspected ransomware intrusion.
Notification and Disclosure
According to the county, affected individuals were notified, and information was posted to the county’s website. The broader public notification to media did not occur until May 12, nearly four months after the ransomware was first discovered. That gap reflects the time often needed to complete forensic investigations before agencies can accurately determine who was affected.
The Decision to Pay
Commissioners said the payment decision was made in coordination with the county’s insurance carrier. The stated rationale was twofold: restoring county services fully and protecting personal information that may have been exposed in the attack. The county did not disclose which ransomware group was behind the attack or the specific systems that were affected.
A Second, Separate Ransomware Incident in April
Winona County disclosed that a second ransomware incident, unrelated to the January attack, was detected on April 7. As with the first case, officials launched an investigation using cybersecurity and data-forensics consultants and notified both federal law enforcement and state agencies.
What’s Still Under Review
The county said it is actively reviewing the data affected by the April incident to determine the scope of the breach and identify who was impacted. This process typically involves scanning compromised systems for personally identifiable information before individual notification letters can be issued.
Credit Monitoring for Affected Residents
The county said residents whose Social Security numbers or driver’s license numbers were affected by the April incident will be offered complimentary credit monitoring and related identity-protection services. That offer will be included directly in the notification letters sent to affected individuals once the review is complete.
Why Local Governments Remain Ransomware Targets
Local governments like Winona County are frequent ransomware targets because they manage large volumes of sensitive resident data, such as property records, court filings, and driver’s license information, often on legacy IT systems with limited cybersecurity budgets. That combination makes county networks an attractive target for cybercriminals seeking either ransom payments or resalable personal data.
Comparing the Two Incidents
| Detail | January Incident | April Incident |
|---|---|---|
| Date detected | January 22 | April 7 |
| Investigation involved | Third-party forensic experts, federal law enforcement | Cybersecurity and data-forensics consultants, federal law enforcement, state agencies |
| Payment made | $128,539.57 | Not disclosed |
| Public notification | May 12 | Pending review |
| Credit monitoring offered | Not specified | Yes, for affected Social Security/driver’s license numbers |
What Comes Next
Commissioners said both ransomware incidents underscore the ongoing threat posed by sophisticated cybercriminals targeting local government systems. County officials said they intend to continue taking steps to reduce the risk of future attacks, though they have not detailed specific technical or policy changes.
The outcome of the county’s review into the April incident will determine the next wave of resident notifications. Until that review is finished, the full scope of the second ransomware attack, including how many residents are affected, remains unknown.
