A small county in southeastern Minnesota is now dealing with its second ransomware attack in under ninety days. The first one hit in January, knocked systems offline for weeks, and led to a declared emergency. The second arrived on April 7 while the county was still implementing security improvements from the first. This time, the state sent the National Guard. The story of Winona County is not just a local government IT failure. It is a compressed, real-time case study in why ransomware actors return to the same targets, why recovery does not equal resilience, and why the gap between restoring operations and hardening infrastructure remains the most dangerous window in cybersecurity.
Winona County has a population of roughly 50,000 people. It sits along the Mississippi River, home to a state university, bluff country hiking, and the kind of county government infrastructure that handles property records, birth certificates, motor vehicle registrations, and court filings. It is the kind of place where a single ransomware event can stop someone from closing on a house, registering a car, or obtaining a death certificate for a family member. When the systems go down, the consequences are not abstract. They are tangible, immediate, and felt by people standing at a counter being told to come back later or try a neighboring county.
The Timeline: January Through April
The first ransomware attack was discovered on January 22, 2026. The county's IT systems were knocked offline, and County Board Chair Chris Meyer signed a declaration of local emergency under Minnesota Statute 12.29 subd. 1. Emergency services, including 911, fire, and EMS, continued operating without interruption, but administrative systems were severely impacted. Tax records, motor vehicle services, and three interconnected real estate databases — LandShark, OnBase, and LandLink — went dark. These systems are supplied by TriMin Government Solutions (a vendor specializing in Register of Deeds and County Recorder software, not the more commonly cited Tyler Technologies) and are the systems title companies and banks depend on to verify ownership during property transactions. County Recorder Bob Bambenek confirmed some real estate closings in the county could not be completed until systems were restored.
The county brought in third-party cybersecurity and forensics experts, coordinated with federal law enforcement, and began the slow process of recovery. By late February, roughly four weeks later, the county described the first incident as largely resolved. County Administrator Maureen Holte stated that stolen data had been restored, though she declined to say whether a ransom had been paid, whether insurance covered the cost, or whether personal data had been compromised.
Then on April 7, less than eleven weeks after the first attack was discovered, a second ransomware incident was detected on the county's network. The attack began on April 6 and was detected the following morning — a one-day gap that Governor Walz's executive order captures accurately where the county's public statement does not. County officials once again took systems offline to contain the threat. The DMV and vital statistics services — which depend on internet connectivity to the state — went down and remained unavailable as of April 11. Staff across the county reverted to pen and paper. Residents needing DMV services were directed to neighboring counties. E-Recording submissions were formally halted on April 8, with real estate submissions arriving by mail or drop box held until the date received rather than processed on receipt.
Holte confirmed in a public statement that the second attack was attributed to a different threat actor than the first. She also noted that the security improvements prompted by the January incident helped the county detect and respond to the April attack more quickly. That detail is important: it means the first attack did produce operational learning. The problem is that operational learning and operational hardening exist on different timelines, and the attackers moved faster than the upgrades could be completed.
The Repeat Target Problem
This is the part of the Winona County story that deserves the closest attention, because it reflects a pattern that extends far beyond one county in Minnesota.
Research from cybersecurity firm Cybereason has consistently shown that organizations struck by ransomware face an elevated risk of being hit again. In its 2024 study, Cybereason found that 78 percent of organizations that paid a ransom demand were subsequently targeted in a second attack. Of those repeat victims, 36 percent were struck by the same threat actor and 42 percent by a different one. In 63 percent of repeat cases, the second ransom demand was higher than the first.
Winona County officials have not confirmed whether a ransom was paid after the January attack. But the broader data raises a critical question regardless of payment: why do ransomware operators return to previously compromised organizations?
The answer lies in how ransomware ecosystems operate. Threat actors who compromise a network gain detailed knowledge of its architecture, its weaknesses, and its response capacity. That intelligence does not disappear when the ransom is paid or the systems are restored. It can be retained, shared, or sold. In the ransomware-as-a-service model, initial access brokers often sell network footholds to multiple buyer groups. A compromised network is not a closed chapter; it is a live lead that multiple criminal operators can exploit. Mandiant's 2026 M-Trends report found that "prior compromise" — access inherited from an earlier, separate intrusion — was the initial infection vector in approximately 30 percent of the ransomware incidents it investigated in 2025, nearly double the prior year's share. A staggering statistic in the same report: the median time between an initial access event and the hand-off to a secondary threat group has collapsed from more than eight hours in 2022 to just 22 seconds in 2025.
Even when the second attacker is genuinely different from the first — as Winona County officials indicated — the underlying conditions that made the first attack possible often persist during the recovery window. Unpatched endpoints, legacy authentication configurations, incomplete network segmentation, and residual footholds from the first intrusion can all leave the door propped open for a separate group to walk through.
A publicly disclosed ransomware incident functions as an unintentional signal to the broader threat ecosystem. It tells other operators that the target's defenses were breached, that its staff are now consumed with recovery and investigation, and that its security posture is likely in a transitional state. For opportunistic attackers scanning for vulnerable organizations, a recent victim is a high-probability target.
Before returning to a previously compromised target, a ransomware operator (or an initial access broker selling the foothold) runs through a set of implicit questions. Walk through the tree below. Each node reveals the reasoning — and why Winona County triggered a "yes" on many of them.
What the National Guard Deployment Means
Governor Tim Walz authorized the deployment of 15 IT specialists from the Minnesota National Guard's 177th Cyber Protection Team to assist Winona County. This is not a unit of soldiers with rifles standing outside a server room. It is a team of cybersecurity professionals who hold civilian jobs in IT and security across the Twin Cities metro area and serve as military reservists trained in network defense, threat hunting, and incident response. The unit has no junior enlisted slots — it is built entirely from branch transfers and personnel who already bring years of civilian information-security experience. Ideal candidates, according to the unit's leadership, are "life-long learners who also do this stuff as a hobby, in addition to a career."
Minnesota established its Cyber Protection Team in 2017 at Rosemount, making it one of the first states in the nation to do so. When it stood up, the 177th was one of 23 such units across the National Guard. Minnesota was, and remains, one of only a handful of states to have fully staffed a complete team rather than sharing one across state lines. The unit reached Fully Operational Capability (FOC) in July 2020 after passing an ARCYBER validation exercise at Fort Meade — a rare benchmark that thousands of hours of training precede. In October 2020, the 177th was federally mobilized under the 780th Military Intelligence Brigade (Cyber) in support of U.S. Cyber Command and the Cyber National Mission Force, returning to Minnesota in late 2021. In 2025, the team was activated for a major ransomware incident against the city of St. Paul, where it spent several weeks assisting with threat removal and network hardening.
The team's mission in Winona County involves three core tasks: hunting for residual threat actors inside the network, clearing any remaining adversary presence, and hardening the infrastructure against future intrusions. Lt. Col. Brian Morgan, the Minnesota National Guard's Director of Cyber Coordination (and former commander of the 177th when it achieved FOC), described the typical attacker playbook as focused on gaining access, deploying ransomware, and either extorting payment for decryption or threatening to release stolen data.
The deployment also involves coordination with the Minnesota Bureau of Criminal Apprehension, the FBI, Minnesota IT Services, the League of Minnesota Cities, and an external cybersecurity vendor. The sheer number of agencies involved illustrates an uncomfortable truth: a single county's IT staff cannot handle a sophisticated ransomware incident alone, and the second time around, the county's own resources were simply overmatched.
"The scale and complexity of this incident has exceeded both internal and commercial response capabilities." — Governor Walz's executive order authorizing the National Guard deployment
A single county's network does not face a single attacker. It faces a distributed economy. Click any node to see its role and how it connects to the rest. The arrows show the flow of access, malware, payment, and data.
The Recovery-Resilience Gap
This is the concept that the Winona County case makes viscerally clear: recovering from a ransomware attack and becoming resilient against the next one are two different things, and there is a dangerous gap between them.
Recovery means restoring data, bringing systems back online, and returning to operational capacity. It is measured in uptime and service availability. The January attack was "largely resolved" by late February, meaning the county's systems were functional again within about four weeks. That is a reasonable recovery timeline for a county-level government.
Resilience means fundamentally improving the security architecture so that a similar intrusion either cannot succeed or can be contained before it causes meaningful disruption. That work — network segmentation, endpoint detection and response deployment, privilege access management, authentication hardening, backup architecture validation, and staff security training — takes months, requires budget, and often requires vendors and expertise that are not immediately available.
Holte acknowledged this gap directly when she noted that the county was in the process of implementing critical network improvements when the second attack occurred. The improvements were not vaporware or empty promises. They were real projects underway. In fact, Holte credited those in-progress upgrades with helping the county detect the second incident faster. But detection speed and prevention are different capabilities, and the attackers exploited the window before the hardening was complete.
This gap is not unique to Winona County. It is structural. Local governments typically operate with small IT teams, limited budgets, and procurement timelines that do not align with threat actor timelines. A county that needs to hire a managed security service provider, procure endpoint detection tools, and redesign network segmentation is looking at a process measured in quarters, not weeks. Attackers operate in days. Mandiant analysts have given the current pattern a name: "recovery denial." In 2025 investigations, ransomware operators actively targeted backup infrastructure, identity services, and virtualization management planes specifically to remove the victim's ability to rebuild without paying. Separately, NAIC's 2025 market research found attackers specifically targeted backups before triggering encryption in 72 percent of ransomware incidents — which is why cyber insurance carriers increasingly require immutable, isolated backup systems as a condition of coverage, not a best practice.
Recovery tracks operational uptime. Hardening tracks security posture. They run on different clocks — and the gap between them is when repeat attackers strike. Toggle the layers to see how Winona County's timeline maps onto this structural problem.
Picture the resource asymmetry concretely. A county IT director has a fixed headcount, a procurement cycle measured in months, a board that must publicly approve contracts above a threshold, and a constituency that expects services to stay online. Every action is observable. Every delay is accountable.
Now picture the opposing side. A ransomware affiliate operates under no disclosure obligation. The affiliate does not report to a board. The affiliate can pivot tooling in a single afternoon, buy a new access point at 9pm, and has access to a labor market that will translate, localize, and automate attacks in whatever language the target speaks. The affiliate pays no opportunity cost for being wrong about a target; there is always another county.
This is why "spend more" is not, by itself, a complete answer. More budget buys tools, but it does not collapse the structural asymmetry between an organization bound by public-sector process and an adversary bound by nothing. Partial relief comes from state-level cyber units, shared services across counties, and mutual-aid agreements — mechanisms that move some of the defensive capability outside any one county's procurement cycle. The Minnesota National Guard's cyber team is exactly that kind of structural workaround.
The Bigger Picture: Local Government Under Siege
Winona County exists within a broader pattern that has been accelerating for years. Minnesota IT Services reported close to 70 ransomware attacks across the state in a twelve-month period spanning 2024-2025, with more than half targeting local governments and schools. Mower County, Minnesota and Iowa County, Wisconsin both suffered ransomware attacks in 2025. The city of St. Paul experienced a major incident on July 25, 2025 that required National Guard intervention; the Interlock ransomware group (a RaaS operation that emerged in September 2024 with probable links to the Rhysida group) exfiltrated 43 gigabytes from St. Paul's estimated 153 terabytes and posted the data on its leak site after the city refused to pay. St. Paul's recovery required a manual password reset of over 3,000 employees at Roy Wilkins Auditorium, took roughly 90 days of emergency-order operations, and was still approximately 75% complete two months after the initial containment.
Nationally, the numbers are stark. Comparitech tracked 7,419 ransomware attacks worldwide in 2025, with government entities experiencing 374 total recorded incidents — a 27 percent increase over the prior year, with 196 of those confirmed by the affected organizations themselves. The first half of 2025 alone saw a 65 percent year-over-year increase in ransomware incidents affecting government bodies, according to Comparitech's H1 2025 Government Ransomware Roundup. And those are only the reported figures. BlackFog's 2025 State of Ransomware Annual Report estimated that 86 percent of ransomware incidents are never publicly disclosed — a figure it derived by comparing publicly disclosed incidents against the much larger universe of victims named on dark web leak sites.
The reasons local governments are disproportionately targeted are well documented: they hold large volumes of sensitive personal data (Social Security numbers, financial records, health information, property records), they operate on constrained IT budgets, they rely on legacy systems, and they face political pressure to restore services quickly — which can translate into a higher likelihood of ransom payment. The financial motivation is straightforward. A county government that holds birth certificates, death records, and property titles for its entire population is sitting on data that creates extraordinary pressure to pay when it is encrypted or stolen.
The defender picture has also quietly worsened in the months before the Winona attacks. On October 1, 2025, the Multi-State Information Sharing and Analysis Center (MS-ISAC) — the primary threat-intelligence and incident-response resource for state, local, tribal, and territorial governments — transitioned from federal CISA funding to a fee-based membership model. By April 2026, at least 13 states had signed statewide agreements. Federal State and Local Cybersecurity Grant Program (SLCGP) dollars cannot be used to pay MS-ISAC fees. For a county with fewer than five dedicated cybersecurity staff — the condition that applies to more than 80 percent of U.S. local governments — losing the MS-ISAC incident-response and indicator-feed lifeline precisely as the adversary economy accelerates is not a footnote. It is structural exposure.
Research published in Information Systems Research introduced the concept of "extortionality" — the idea that a ransom payment creates a negative externality by incentivizing further attacks, not only against the paying organization, but against other potential victims in the same sector. When a county pays, it validates the business model for every other ransomware operator scanning county-level targets.
This is not a forecast tool. It is a teaching instrument. Adjust the inputs based on a hypothetical local government's profile and watch how the probability of a second attack shifts. The base rate is anchored to Cybereason's 2024 finding that 78 percent of organizations that paid a ransom were hit again.
What Winona County Reveals About the Road Ahead
Winona County Emergency Management Director Ben Klinger made a statement during the April 11 press conference that is worth sitting with: the county's emergency management plans worked. When the attack was detected, systems were taken offline to contain the threat. Emergency services continued without interruption. Staff pivoted to manual processes. State and federal partners were mobilized. The playbook was executed. And yet, here they were, managing a second crisis in under three months.
This is what makes the Winona County case so instructive. It is not a story of negligence or indifference. It is a story of a small government that took its first attack seriously, invested in improvements, and was still overwhelmed by the structural reality of defending against an adversary ecosystem that moves faster, is better funded, and has no procurement cycle.
The lesson is not that Winona County failed. The lesson is that the model of incident response followed by incremental improvement is insufficient for organizations in the crosshairs of repeat targeting. The current approach treats each ransomware incident as an isolated event to be recovered from, rather than as evidence of an ongoing, adversarial relationship between the victim's network and the broader criminal ecosystem that now knows it exists.
For Winona County, the immediate path forward involves the National Guard completing its threat hunting and hardening mission, the FBI and BCA continuing their criminal investigation, and the county restoring DMV and vital statistics connectivity to the state. Longer term, the county will need sustained investment in security architecture that outlasts the news cycle and the emergency declaration.
For every other county, school district, and municipal government watching this unfold, the Winona County timeline offers a compressed illustration of a truth that the cybersecurity community has been repeating for years: the window between recovery and resilience is when you are most vulnerable, and the attackers know it.
The term "incident" suggests a discrete event. It frames the work as something that has a beginning, a middle, and an end — you get hit, you respond, you close the ticket. That framing made sense when intrusions were rare and the operator who hit you was the same one who walked away.
That model no longer maps to how the ransomware economy functions. Access is bought and sold. Footholds are rented. Victim lists are traded. The "ticket" you closed in February was read, five weeks later, by a different affiliate who paid a different broker for a different partial picture of your network. From the defender's side, one incident ended; from the ecosystem's side, the same target became a rotating asset.
Some practitioners have proposed replacing "incident response" with "adversary engagement" or "continuous compromise management" as a mental model. The distinction matters because it changes what you plan for. You stop planning for a close-out and start planning for a sustained campaign. You stop measuring mean time to recover and start measuring mean time to shift posture. Winona County is an argument, in real time, that the older model no longer scales.
Three decision points a real county administrator faced in the weeks between the two Winona attacks. There are no perfect answers. Each choice carries a tradeoff. Pick one, read the consequence, and move on to the next.
Precise, sourced specifics that reshape how experienced practitioners should think about this incident and the broader repeat-targeting problem. Filter by category to find what is genuinely new to you. Every claim here is drawn from the record — not hedged estimates or sector generalities.
Retrieval practice is one of the most robust memory effects in cognitive science. Answering from memory, even imperfectly, binds information far better than re-reading. Give these a shot before scrolling to the key terms.