Loading story…
Winona County, Minnesota, detected ransomware on its IT network on January 22, 2026, engaged third-party forensic specialists, notified federal law enforcement, and negotiated with the attackers. With support from its cyber insurer, the county paid $128,539.57 in ransom; it sent written notifications to affected individuals and made public disclosures on May 12.
The county subsequently detected a second, apparently unrelated ransomware incident in April. That intrusion remained under investigation, underscoring that the county experienced two distinct ransomware attacks against its environment in 2026.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Winona County sent written notifications to affected individuals concerning the January ransomware incident and publicly communicated the incident through its website and the media.
Winona County detected a second ransomware attack, described as unrelated to the January incident. The second incident remained under investigation at the time of reporting.
Winona County, Minnesota, detected a ransomware attack against its information-technology network. The county retained third-party forensic specialists, notified federal law enforcement, and later negotiated a ransom payment with support from its cyber insurer.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Minnesota Governor Tim Walz issued an emergency executive order authorizing the Minnesota National Guard to help Winona County respond to a cyberattack that disrupted the county’s **critical systems** and digital services. County officials discovered the incident on Monday and said the attack significantly impaired delivery of emergency and municipal services, with some police department phone transfer functions reportedly unavailable. The county has been coordinating with the **FBI**, the Minnesota Bureau of Criminal Apprehension, the state IT agency, a cybersecurity vendor, and the League of Minnesota Cities. State officials said the scale and complexity of the intrusion exceeded the county’s internal and contracted response capabilities, prompting emergency state support. The incident marks the second successful cyberattack reported against Winona County in the same year, following an earlier breach that knocked out systems used for real-estate transactions and police file access before service was restored.
Jun 29, 2026
Union County, Ohio, experienced a significant ransomware attack in May 2025 that resulted in the compromise of sensitive personal data belonging to 45,487 individuals, including both residents and county employees. The attack was detected on May 18, 2025, after cybercriminals had maintained unauthorized access to the county’s network from May 6 to May 18. During this period, the attackers exfiltrated a wide range of sensitive information, such as names, Social Security numbers, financial account details, driver’s license numbers, medical information, fingerprint data, and passport numbers. Upon discovery of the ransomware, Union County officials immediately launched an investigation, enlisting the help of nationally recognized third-party cybersecurity and data forensics consultants to secure their network and determine the scope of the breach. Federal law enforcement agencies were also notified as part of the county’s incident response. By August 25, 2025, the county had completed its review of the breach and began sending notification letters to all affected individuals, outlining the types of data compromised and the steps being taken in response. As of late September 2025, no known ransomware group had claimed responsibility for the attack, and the specific threat actor remains unidentified. The breach notification letters emphasized the breadth of the data stolen, highlighting the potential risks for identity theft and financial fraud among those affected. Union County, with a population of over 75,000 and recognized as one of Ohio’s fastest-growing regions, faced significant operational and reputational challenges as a result of the incident. The attack on Union County is part of a broader trend of ransomware campaigns targeting state, county, and city governments across the United States in 2025. Other recent incidents have included attacks on North Carolina’s Waxhaw town, where the Qilin ransomware gang exfiltrated over 600 GB of data, as well as separate breaches affecting Ohio’s Lorain County and the Maryland state government. The Union County incident underscores the persistent threat posed by ransomware actors to local government entities and the critical importance of robust cybersecurity measures, timely incident response, and transparent communication with affected stakeholders. The county’s response included not only technical remediation but also public disclosure and cooperation with law enforcement, reflecting best practices in breach management. The full impact of the breach, including any potential misuse of the stolen data, remains to be seen as investigations continue. Union County’s experience serves as a cautionary example for other local governments regarding the risks of ransomware and the need for comprehensive data protection strategies.
Jun 29, 2026
The US Treasury Department's Financial Crimes Enforcement Network (FinCEN) released a comprehensive report analyzing ransomware activity and payments from January 2022 to December 2024. The report revealed that over this three-year period, organizations reported 4,194 ransomware incidents and paid more than $2.1 billion in ransoms, nearly matching the $2.4 billion paid over the previous nine years. Ransomware payments peaked in 2023 at approximately $1.1 billion, followed by a significant decline to $734 million in 2024, a drop attributed to major law enforcement actions against prominent ransomware groups such as ALPHV/BlackCat and LockBit. Despite the decrease in payments, the number of reported incidents only slightly declined, indicating that while attacks remain frequent, fewer victims are paying ransoms. The report highlighted that the manufacturing, financial services, and healthcare sectors were the most targeted, with financial institutions suffering the largest monetary losses. The vast majority of ransom payments (about 97%) were made in Bitcoin, and most funds were laundered through unregulated cryptocurrency exchanges. The median ransom payment peaked at $174,000 in 2023 before dropping to $155,257 in 2024. The data underscores the evolving nature of the ransomware threat landscape and suggests that coordinated law enforcement efforts can have a measurable impact on the financial incentives driving ransomware operations.
Jun 29, 2026