The attack began on April 6 and continued into April 7, impacting core digital infrastructure used for emergency response and municipal operations. Officials said the incident significantly affected their ability to manage essential services, including administrative and public-facing functions.
Governor Tim Walz responded by signing an executive order authorizing the Minnesota National Guard to support recovery efforts.
"Cyberattacks are an evolving threat that can strike anywhere, at any time," said Governor Walz. "Swift coordination between state and local experts matters in these moments. That's why I am authorizing the National Guard to support Winona County as they work to protect critical systems and maintain essential services."
County officials confirmed that teams have been working continuously since detecting the breach. The response involves coordination with Minnesota Information Technology Services, the Minnesota Bureau of Criminal Apprehension, the League of Minnesota Cities, the Federal Bureau of Investigation, and external cybersecurity experts.
Despite these efforts, authorities acknowledged that the scale and complexity of the attack exceeded both internal capabilities and commercial support, prompting a formal request for assistance from the National Guard.
Under the executive order, the Adjutant General is authorized to deploy personnel, equipment, and additional resources to assist with the response. The state can also procure necessary services, with costs covered through Minnesota’s general fund.
The order is currently active and will remain in place until the situation stabilizes or is officially lifted. The immediate focus is on containing the threat, preventing further damage, and restoring affected systems.
Officials emphasized that emergency services remain operational. Systems supporting 911 calls, fire response, and other urgent services are functioning, ensuring public safety is not compromised.
However, disruptions have slowed other county operations, and residents may experience delays while systems are restored.
Authorities have not yet disclosed the exact nature of the cyberattack or confirmed whether ransomware is involved.
The FBI, along with state agencies and cybersecurity experts, is investigating the incident. The probe aims to determine how the breach occurred, identify affected systems, and assess whether sensitive data was accessed.
This event follows a ransomware incident reported by Winona County in January 2026.
At that time, officials stated, "We recently identified and responded to a ransomware incident affecting our computer network. Upon discovery, we immediately initiated an investigation to assess the scope and impact of the incident."
During the earlier attack, a local emergency was declared to maintain service continuity. While emergency operations remained active, other services faced temporary disruptions.
The recurrence of cyber incidents within a short period has raised concerns about ongoing vulnerabilities and the growing cyber threat landscape for local governments. The incident highlights a broader trend: smaller government bodies are increasingly targeted by sophisticated cyberattacks but often lack the resources to respond effectively.
As systems go offline, public services are immediately affected, and recovery can take time. While state support is helping stabilize operations in Winona County, the situation underscores the need for stronger cybersecurity defenses at the local level.