Winona County, Minnesota: second ransomware attack of 2026, National Guard deployed

What happened

• Ransomware was detected on 7 Apr 2026 (attack began 6 Apr per The Record); all affected systems were taken offline and Governor Walz signed an executive order sending the Minnesota National Guard cyber team. 911, fire and emergency services kept operating. The county’s notice says criminals were on the network from 13 Mar to 7 Apr and copied data including SSNs, driver’s license numbers, financial and medical data, law-enforcement report data, passport and immigration numbers, fingerprints and paternity DNA reports. The county had suffered a separate ransomware attack in January 2026 (network accessed 18 to 22 Jan).
• Root cause / initial access: not disclosed.
• Attacker: not named; the county said preliminary findings indicated a different attacker from January’s.
• Response: FBI and MNIT involved; network restored, EDR deployed, enterprise-wide password reset; letters mailed from 8 Oct 2026.

Sources

• https://therecord.media/minnesota-sends-national-guard-after-local-cyberattack
• https://www.winonacounty.gov/31/Notice-of-Data-Security-Incident

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.