Winona County Hit by Second Cyberattack, Receives National Guard Support Winona County, Minnesota, experienced its second cyberattack in recent weeks, prompting Governor Tim Walz to deploy emergency assistance. The incident, which occurred on Monday, led local authorities to request National Guard support to bolster cybersecurity defenses and mitigate further disruptions. The attack follows a prior incident that also targeted county systems, though specific details about the nature of the breaches including whether ransomware or data theft was involved have not been disclosed. The National Guard’s involvement underscores the severity of the situation, as officials work to restore affected services and prevent additional vulnerabilities. No further information on the attackers’ identities or motives has been released. The county continues to assess the full impact of the cyberattacks on government operations and critical infrastructure.

Winona County Data Breach Exposes Sensitive Resident Information in January Cyberattack Winona County, Minnesota, notified residents in mid-May that their personal data was compromised during a cyberattack in January. The breach, detected on January 22, occurred between January 18 and 22, with cybercriminals accessing and exfiltrating sensitive information from county systems. A forensic review completed on April 16 identified the types of data exposed, which included names, addresses, Social Security numbers, driver’s license details, medical records, law enforcement report information, financial account data, and payment card details including CVV numbers and expiration dates. A small subset of individuals also had online account credentials and passwords compromised. Upon discovering the incident, county officials secured their network, launched an investigation, and collaborated with the FBI. Additional security measures were implemented to prevent future breaches, and state regulators were notified. The county’s public notice, published on May 12, confirmed that affected residents were informed via mail. This breach is separate from a subsequent ransomware attack in April, about which few details have been disclosed. The full scope and impact of the April incident remain unclear.