Winona County cyberattack: an April 2026 ransomware attack, the National Guard, and letters to 123,476 people

Was Winona County hit by ransomware?

The county's own notice calls it "the April 2026 ransomware attack", and it says letters to the people involved began going out on October 8, 2026. The notice is posted on the county website for people the county has no good address for. It does not name a ransomware group or say how the intruders got in.

Minnesota's governor dates the attack one day earlier than the county does. His emergency executive order says the county was attacked on Monday, April 6, 2026, and that the attack ran overnight into Tuesday, April 7. The county's notice gives April 7 as the day it detected ransomware, so the two dates may describe the start of the attack and the moment of detection.

Why was the National Guard sent to Winona County?

The county asked for it. Governor Tim Walz signed Emergency Executive Order 26-06 on April 7, 2026, after the county requested cyber protection support from the Minnesota National Guard. The order gives the reason in plain terms: the incident was bigger and more complex than the county's own staff and its commercial responders could handle. It lets the Adjutant General put personnel and equipment on state active duty, with the cost paid from the state's general fund.

The governor's office listed who was already working on the attack: Minnesota IT Services, the Bureau of Criminal Apprehension, the League of Minnesota Cities, the FBI and outside cybersecurity experts. MPR News reported that the county also declared a local state of emergency.

What county services did the attack shut down?

The county took parts of its network offline to contain the attack. At a press conference reported by Government Technology, the county's emergency management director said the Department of Motor Vehicles and vital statistics systems were offline, and that neighboring counties could help residents with DMV services. He said 911 calls, law enforcement, fire, EMS and dispatch were still running. Systems came back one at a time as each was checked, rather than all at once.

What information was taken in the Winona County breach?

The county's list is long. It covers name, address, date of birth, Social Security number, driver's license or state ID number, financial account and card information, medical and health insurance information, and information in law enforcement reports. It goes on to immigration identification numbers, passport numbers, ITINs, fingerprints, DNA reports related to paternity testing, military service and veteran ID numbers, and usernames and passwords for non-financial accounts. The county reviewed what was involved for each person, so each letter should say which of these types applied to its reader.

Massachusetts's list, which marks four data types per notice, shows Social Security numbers and driver's licenses breached for its 10 residents.

How many people were affected?

Indiana's record gives the only total: 123,476 people for the breach that began on March 13, 2026. That puts Winona County third among the city and county governments in Indiana's 2026 report, after the City of Suffolk, Virginia, and the City of Middletown, as the guide to city and county breach notices shows. The notice does not say who the total covers: residents, former residents, employees, or people whose records the county holds for courts, vital records or public health. Massachusetts counts 10 of its residents; the county reported to Massachusetts on October 14, 2026.

Date	What happened	Source
January 2026	A first, separate ransomware incident at the county (breach date January 18 in Indiana's record)	Indiana record; KTTC
March 13, 2026	Intruders first in the network, per the county; breach date in Indiana's record	County notice; Indiana record
April 6, 2026	Attack begins, per the governor's order	Executive Order 26-06
April 7, 2026	County detects ransomware; Executive Order 26-06 signed	County notice; Executive Order 26-06
October 8, 2026	Letters begin going out; notice date in Indiana's record	County notice; Indiana record
October 14, 2026	Reported to Massachusetts (10 residents)	Massachusetts record

The letters went out 184 days after the county detected the attack. The county says it first restored its network and then reviewed what information was involved, who was affected and where they live. It also says the notice was not held back for a law enforcement investigation. The notice-delay guide compares gaps like this one across the log.

Was this Winona County's first cyberattack of 2026?

No. MPR News reported that the April attack was the county's second of the year, after one in January, and that county officials said a preliminary investigation pointed to different criminal actors. Indiana's report carries the January incident as its own notice: 6,196 people in total, 4 in Indiana, breach date January 18, notice sent May 7, 2026. Massachusetts logged it on May 18, 2026, with 2 residents.

In a joint update reported by KTTC in August, the county board said it negotiated and paid $128,539.57, with help from its insurance carrier, in connection with the January incident. The same update described the April attack as separate from and unrelated to the January one.

What is Winona County doing, and what should I do?

The county lists three changes: new security tools to detect and respond to attacks faster, endpoint detection tools watching the network, and a password reset across the whole organization. The web notice itself does not offer credit monitoring. KTTC reported in August that the county would offer free credit monitoring and identity protection to people whose Social Security or driver's license numbers were in the April data, so the letter is where to look for an enrollment code.

The notice asks people to watch their account statements and credit reports, and gives a toll-free line, 1-866-200-0895, open 8 a.m. to 8 p.m. Central time on weekdays. Because the list includes passport numbers, ITINs and fingerprints, which a credit freeze does not protect, the guide to credit monitoring offers in breach letters explains what the usual offers cover and what they leave out.

Was my information in the Winona County data breach?

If you got a letter from Winona County mailed on or after October 8, 2026, your information was in the copied data, and the letter should say which types. If you have dealt with the county, for example through its courts, vital records, licensing, health and human services or employment, and you got no letter, the toll-free line above is the county's channel for questions. The county posted its web notice for exactly that case: people it could not reach by mail.

What the notice leaves open

• How the intruders got in, and whether the county paid anything in connection with the April attack.
• Who the 123,476 people are: residents, former residents, employees or people with county records.
• Which ransomware group, if any, claimed either attack.
• What the National Guard's cyber team did and when the order ended.