Winona County, Minnesota has confirmed it paid $128,539.57 to resolve a ransomware attack detected on its network on January 22, 2026, and that a second, separate ransomware incident hit the same network on April 7, 2026. The disclosure came in an August 28 county statement published in full by the Winona Post and reported by WXOW. The county says the payment was negotiated with the assistance of its insurance carrier and describes the two intrusions as unrelated. A comprehensive review of affected data is still underway, and local reporting indicates Social Security numbers are among the data types in scope.
What Happened
The county's own account, reproduced verbatim by the Winona Post, lays out a clear two-incident timeline. Ransomware was detected on the county computer network on January 22, 2026. Winona County engaged third-party forensic experts and notified federal law enforcement. On May 12, 2026, it sent written notification to impacted individuals and posted notice on its website and to the media covering the January incident.
To restore services and, in the county's framing, to protect personal information, Winona County "negotiated and paid a fee of $128,539.57 with assistance from our insurance carrier." Officials called it a difficult choice and said they concluded it was the necessary approach to serve the interests of residents and employees. WXOW reports the same figure and the same rationale.
Then, on April 7, 2026, roughly eleven weeks after the first detection, the county detected a second and, per its statement, "separate and unrelated" ransomware infection on the same network. It again brought in outside forensics consultants and notified federal law enforcement plus the appropriate state agencies. That second investigation is the one officials describe as ongoing.
Accounts diverge on framing and on operational impact. The county statement never uses the word "ransom," calling the outlay a negotiated "fee." The Winona Journal reports it flatly as a $128,000 ransom paid "for coding to unlock the system," attributing confirmation of the sum to County Administrator Maureen Holte. The Journal also reports that Holte declined to answer follow-up questions, including whether the money came from county coffers or from a state-level municipal liability policy, what the forensic consultants cost, whether the same attackers were responsible for both intrusions, and why the payment was not disclosed until August. Those questions remain open. Readers should note the Journal is the only source alleging institutional "laxity" as a contributing factor, and it presents no evidence for that characterization.
Only the Winona Journal describes the operational blast radius, and its claims are not corroborated by the county statement or by WXOW: that the integrated county and city police communications network was disabled, that real estate transactions halted because the county recorder lost access to property data, and that the jail roster went dark. If accurate, that is a full-spectrum county government outage, not a contained IT event.
What Was Taken
No source publishes a victim count. The county says it is "conducting a comprehensive review of the affected data," which is standard language for an incomplete data-mining exercise, and the excerpt available cuts off before any scoping figure.
On data types, the sources differ in confidence. WXOW's headline frames Social Security numbers as data that "may be at risk," consistent with the county's own hedged, review-pending posture. The Winona Journal goes further, asserting that personal information on county employees and the general public was in the hands of the attackers, specifically including Social Security numbers and driver's license numbers. Treat the Journal's version as a single-source claim pending the county's completed review. What both agree on: the sensitive-identifier categories are in play, and the county already mailed notification letters for the January incident on May 12.
The unanswered question that matters most for residents is whether the April incident produced its own separate exposure, and whether a second round of notifications is coming. The county has not said.
Why It Matters
The reinfection is the story. Two ransomware events on the same network in eleven weeks, which the county characterizes as unrelated, points to one of a small number of unpleasant possibilities: an initial access vector that was never actually closed, credentials or tokens harvested in January and resold, an environment rebuilt onto infrastructure that was still compromised, or two independent crews walking through the same unremediated exposure. The county's assertion that the incidents are unrelated is significant precisely because it rules out the most comfortable explanation, that this was one actor with lingering access. If two separate groups got in, the underlying weakness was broadly reachable.
The payment decision also deserves scrutiny. Paying $128,539.57 for a decryption capability did not prevent a second compromise three months later. That is the single most transferable lesson here: a ransom buys decryption, not remediation, and the eradication work that follows is where the money should have been going.
Context matters too. Winona is not an outlier. In Minnesota, Aitkin County Health and Human Services reported a phishing-driven breach affecting 83,114 individuals, with the intrusion beginning April 7, 2026, per Paubox, which is the same date Winona detected its second ransomware infection. There is no reported connection between the two events and none should be inferred, but the date coincidence is worth flagging to analysts tracking Minnesota county targeting. Across the state line, Washburn County, Wisconsin disclosed a cyber incident detected the morning of August 6, 2026, and shut down county technology the same day, per the county's own notice and Fox 21's interview with County Board Chair Lolita Olson. In Maryland, Queen Anne's County notified residents in August 2026 of unauthorized activity potentially exposing names, contact information, government-issued ID numbers, Social Security numbers, and financial and tax records, per databreachrights.com, with neither the intrusion date nor the affected count publicly disclosed.
Small county governments hold the same identity data as large enterprises, run recorder, jail, and emergency communications systems that citizens cannot route around, and staff their security programs at a fraction of the headcount. Public records list Winona County's IT function under a director in post since July 2021, with the LinkedIn profile data describing the organization at 60 to 70 employees, a figure that likely reflects a partial dataset rather than the county's full workforce. Either way, this is a small team defending a wide surface.
The Attack Technique
Neither the county nor any outlet has named the ransomware family, the affiliate, or the initial access vector for either the January or the April intrusion. No leak site posting has been publicly tied to Winona County in the available reporting. The county says only that "sophisticated criminal actors continue to pose an ongoing threat," which is not a technical attribution.
What can be said with confidence: the January incident involved encryption serious enough that the county judged decryption worth paying six figures for, implying either no viable restore path or restoration timelines it could not tolerate. The county's emphasis on "protection of personal information" as a rationale for payment is consistent with a double-extortion model, where the payment also buys a deletion promise, though officials did not say that explicitly.
For the adjacent regional incidents, only Aitkin County has a stated vector: a phishing email chain that compromised an employee mailbox, spread to at least three county email accounts, and allowed the full contents of at least one mailbox to be downloaded within roughly 24 hours, April 7 to April 8. Washburn County has not disclosed a vector. Queen Anne's County has disclosed neither vector nor intrusion date.
What Organizations Should Do
-
Treat post-incident eradication as a separate, funded project from recovery. Winona's April reinfection is the case study. Before declaring an environment clean, force a full credential and secret rotation including service accounts, Kerberos krbtgt, VPN and remote access certificates, API tokens, and any credential that existed on a system touched during the first intrusion.
-
Assume rebuilt does not mean clean. Restore from known-good, offline, integrity-verified backups rather than from snapshots taken after the earliest confirmed attacker activity. Establish the intrusion start date before choosing a restore point, not after.
-
Segment the systems citizens cannot live without. If the Winona Journal's account of disabled police communications, a dark jail roster, and frozen property records is accurate, those functions shared a fate they should not have shared. Emergency communications, detention records, and recorder systems should survive the loss of the general county network.
-
Decide your ransom position before you need it, in writing, with counsel and your carrier. Winona negotiated under duress and is now fielding public questions about who paid, whether insurance covered it, why disclosure took until August, and what the consultants cost. A pre-agreed decision framework and a disclosure timeline answer those questions in advance.
-
Harden the mailbox, because the neighbors are getting hit there. Aitkin County lost the contents of an employee mailbox in about a day. Enforce phishing-resistant MFA, alert on anomalous mailbox rule creation and mass-download events, and cap how much historical sensitive data lives in mail in the first place. The Aitkin exposure was severe largely because a single email carried a state agency report full of Social Security numbers.
-
Shorten your notification decision cycle. Winona detected on January 22 and notified individuals on May 12, then disclosed the payment on August 28. Whatever the legal minimums, extended gaps convert a security incident into a transparency controversy and leave residents unable to freeze credit while their data is already circulating.
Sources: Winona County paid hackers $128K after back-to-back ransomware atta... | Winona County update on ransomware incidents | County paid $128000 ransom to cyber masterminds | Aitkin County Health reports 83k breach after email phishing incident | Chad Lang | Notification of cyber incident Local apg-wi.com | Washburn County gives update on Cyberattack Local & State News fo... | Queen Anne's County Data Breach: What Residents Should Know