Cybersecurity experts issue warning after Winona County pays $128k following ransomware attack

(ABC 6 News) — Cybersecurity experts warn ransomware attacks are an increasing threat to local governments as Winona County continues investigating its second attack of 2026.

While the county says the two attacks were separate and unrelated, cybersecurity experts warn its part of a growing threat.

“A ransomware attack is truly a vicious type of attack,” said Michael Lebowitz, a former Army Cyber Command adviser and national security and cybersecurity attorney. “The impacts can be catastrophic.”

The first attack, detected in January, forced county computer networks offline and disrupted services. After investigating the breach and working with cybersecurity experts and its insurance carrier, the county paid $128,539.57 to help restore its systems.

Related: Winona County paid $128K to resolve January ransomware attack

Winona County officials said the payment was intended to ensure a full and efficient resumption of county services and protect personal information. In a statement, they described it as a difficult decision but “the necessary approach to best serve the interests of Winona County residents and employees.”

However, cybersecurity experts caution that paying ransomware demands is complicated.

“The FBI certainly doesn’t recommend paying the ransom because then they’re known to pay,” said Lebowitz.

Lebowitz explained there is no guarantee that paying a ransom will completely resolve an attack, and payments can also signal to cybercriminals that an organization is willing and able to pay.

At the same time, he said government officials facing an attack have to weigh that concern against the immediate need to restore critical public services and protect sensitive information.

Just three months later on April 6, a second ransomware attack hit Winona County, prompting Governor Tim Walz to issue an executive order providing emergency assistance to the county.

According to a release from the governor’s office, the cyberattack disrupted critical systems and digital services. The attack continued into Tuesday, April 7 and significantly impaired the county’s ability to deliver vital emergency and municipal services.

Related: Minnesota National Guard to provide emergency assistance in Winona County following cyberattack

County officials say the two ransomware attacks were unrelated, but Lebowitz cautioned that the distinction may not be so clear.

“If they have these vulnerabilities and then they never patched it properly for whatever reason, then another ransomware group might have just found a different vulnerability and then targeted it. But again, it’s a very murky world with these ransomware groups,” said Lebowitz. “I wouldn’t be surprised if there’s some, you know, some level of conversation and knowledge that this was paid.”

Winona County’s experience is one of a broader trend, with cybersecurity experts warning of an increasing number of ransomware attacks, specifically those targeting of systems relied on by communities.

“You might think this is just a financial shakedown, but you might be doing material property damage and even affecting life and limb and loss of life,” said Joshua Corman, executive in residence for public safety at the Institute for Security and Technology.

In late July, more than 40 Minnesota water systems were targeted in a coordinated cyberattack linked to Iran. The attacks disrupted operations in multiple communities, although officials reported no long-term damage or impact to drinking-water quality.

Related: Iran-linked group claims responsibility for cyberattacks on Minnesota water systems, report says

And as the use of artificial intelligence continues to grow, cyberattacks are becoming easier and more effective for criminals, according to Lebowitz.

“When they’re using AI, that’s really helping them exploit the vulnerabilities,” he said. They’re finding those vulnerabilities quicker and they’re doing this in bulk.”

Both ransomware incidents remain open criminal investigations, and Winona County says it is conducting a comprehensive review to determine what information was involved and who may have been impacted. The county notes it will send letters to those affected once that review is complete.

If the investigation finds someone’s Social Security number or driver’s license number was compromised, the county says that person’s notification letter will include complimentary credit monitoring, along with related services.