Winona County Pays $128K Ransom After Two Ransomware Attacks

Kttc

Winona County Pays $128K Ransom After Two Ransomware Attacks

First seen 31 Aug 2026, 19:59 UTC • •54.6

Article Content

1 / 9

Browse articles

ThreatCluster •September 1, 2026 at 19:30 UTC

•Winona County paid $128,539.57 in ransom to restore services after a January ransomware attack.
•A second unrelated ransomware attack occurred in April 2026, disrupting critical services.
•County officials emphasize the need for improved cybersecurity measures following these incidents.

Winona County, Minnesota, confirmed it paid $128,539.57 in ransom following a ransomware attack detected on January 22, 2026. The attack forced several county computer networks offline, disrupting municipal services and compromising sensitive personal data. County officials stated the payment was necessary to restore services and protect personal information. A second, unrelated ransomware attack occurred on April 7, 2026, further impairing critical services. The county is currently investigating both incidents. Affected individuals were notified in May 2026, and the county is offering credit monitoring for those impacted by the April attack. Cybersecurity experts warn that paying ransoms can encourage further attacks and does not guarantee recovery of data.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 55d ago How this analysis works

Timeline

2026-01-22

First ransomware attack detected

Winona County's networks were compromised, leading to service disruptions and data theft.

2026-04-07

Second ransomware attack detected

A second ransomware strain hit Winona County, significantly impairing emergency and municipal services.

2026-05-12

Notification letters sent to affected individuals

County officials began notifying individuals whose data was compromised in the January attack.

2026-09-01

County confirms ransom payment

Winona County officials confirmed the payment of $128,539.57 to restore services after the January attack.

More articles in this cluster (8)

Threat Graph

2 entities, 1 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Ransomware

Organization (1)

Winona County

Relationships

Ransomware related to Winona County

Following this threat?

Track Winona County in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…

Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…