Winona County, Minnesota has notified residents that a January ransomware attack compromised county-held data, marking the first of two cyber incidents to hit the county in 2026. Officials said attackers accessed the county network between January 18 and January 22 and stole sensitive data. The review to determine affected information and individuals was not completed until April 16. Exposed data may include names, addresses, Social Security numbers, driver’s license or state ID numbers, medical information, law enforcement report data, financial account information, PMI numbers, and, for a small number of people, payment card data with CVV/expiration dates and online account credentials.

The county also announced a second April ransomware attack, which disrupted Winona County operations and required assistance from the Minnesota National Guard. County systems impacted in April included vital statistics and Department of Motor Vehicles services. Data from the April incident was later released by cyber-criminals. Together, the two incidents show how local governments can face repeated attacks, long forensic timelines, public-service disruption, and serious exposure of citizen data.

This incident underscores why agencies need a unified security, network, and infrastructure data lake that consolidates SIEM, NDR, EDR/XDR, SOAR, identity monitoring, full packet capture, NetFlow/IPFIX, DNS, endpoint telemetry, file access logs, and SNMP-based infrastructure health into one platform. In a Winona-style incident, unified visibility with a platform like NIKSUN lets teams trace the attack from initial access → lateral movement → data staging → exfiltration → ransomware execution, while also determining whether service outages are caused by malware, server failure, network segmentation, or recovery actions. With this approach, agencies can detect ransomware earlier, quarantine infected systems, prove what data was accessed, accelerate notification, and keep critical public services online. Read more about this story on our LinkedIn page