Winona County Hit Again
Winona County suffered a second cyberattack this year that continued to disrupt emergency and municipal services and prompted the governor to mobilize the Minnesota National Guard's cyber protection team. Reports said the attack was still affecting critical services as of recent briefings, underscoring gaps in local recovery capacity and runbook distribution. The episode was cited as evidence that incident response is inseparable from workforce design — alternate operators, mapped dependencies, and treating after-action notes as production work were recommended responses. (govtech.com) (mprnews.org).
Winona County got hit by another cyberattack on Monday, April 6, and by Tuesday the disruption was still bad enough that Governor Tim Walz activated the Minnesota National Guard’s cyber protection team. State officials said the attack was impairing emergency and municipal services, not just knocking out a website. (mprnews.org) The state’s executive order says the attack targeted “critical systems and digital services,” and the county asked for Guard help because of the “scale and complexity” of the incident. That is the kind of language states use when local information technology staff cannot restore operations fast enough on their own. (mn.gov) This was not Winona County’s first round with ransomware in 2026. The county said on January 23 that it had identified a ransomware incident affecting its computer network and had already brought in outside cybersecurity and data forensics experts plus law enforcement. (winonacounty.gov) That January attack was serious enough that county leaders declared a local emergency, but officials said 911, fire, and emergency response operations were still running. By early April, the county was dealing with a second attack less than three months later. (winonacounty.gov) (news8000.com) County Administrator Ben Holte said the January attack was largely resolved by the end of February, which means Winona County barely had time to recover before the next one landed. Holte also said the county had been in the middle of implementing network improvements when the April incident hit. (yahoo.com) That timing helps explain why repeat attacks hurt so much in local government. A county does not just run email and payroll; it runs courts, land records, vital records, tax systems, dispatch links, and the software that lets different offices hand work to each other. (govtech.com) (wfgunderwriting.com) The January outage showed what that looks like on the ground. A title insurance bulletin said the earlier attack affected Winona County land records and vital records software, shut down electronic recording, and forced paper submissions to be held until systems came back. (wfgunderwriting.com) The April response also shows how thin county recovery capacity can be. The National Guard was not sent in to patrol streets; it was sent in for cyber protection support so Winona County could keep municipal operations going while trying to contain and recover from the attack. (mn.gov) That is why this story is less about one county and more about how local government is staffed. If only one person knows how to restart a recorder system, reroute a payment process, or rebuild a server, then an attack can turn a technical failure into a countywide service failure. (govtech.com) The fixes people in this field keep pointing to are not exotic. Counties need backup operators for critical systems, a map of which services depend on which others, and written recovery steps that live somewhere staff can reach when the main network is down. (govtech.com) Winona County’s second attack in one year turned those planning gaps into a live test. When a governor has to call up a military cyber team so a county can keep basic services running, the lesson is that disaster recovery is not a binder on a shelf; it is a staffing plan, a training plan, and a set of instructions people can actually use on a bad Tuesday. (mprnews.org) (mn.gov)
