Winona County ransomware attack prompts Minnesota National Guard deployment

In early April 2026, Winona County in southeastern Minnesota was hit by a ransomware attack that began on Monday 6 April and continued into the following day, impairing the county's ability to deliver emergency and municipal services. The county took affected systems offline; 911 and emergency services remained operational.

On 7 April, Governor Tim Walz signed an executive order activating the Minnesota National Guard's cyber protection team to help the county, saying the incident had exceeded both internal and commercial response capabilities. Guard cyber specialists worked alongside the FBI, which opened an investigation, the state Bureau of Criminal Apprehension, Minnesota IT Services and outside security experts. The county also declared a local state of emergency.

Second attack in three months

It was the second ransomware attack on Winona County in 2026, following one in January. County Administrator Maureen Holte said preliminary findings indicated a different criminal group was responsible this time, and that security improvements made after the January incident had helped the county detect the new intrusion. She warned residents to expect delays for all county services while systems were rebuilt. No ransomware group had publicly claimed the attack in the reporting.

The county later said its network and critical public systems had been securely restored, with close to full operations expected to resume within days.

Why it matters

The case is one of a growing number in which U.S. governors have turned to National Guard cyber units to help small local governments recover from ransomware, because county IT teams and their contractors cannot rebuild systems quickly on their own and the FBI's role is investigation rather than recovery. Repeated attacks on the same small county also show how quickly ransomware crews return to, or find, under-resourced public bodies.