Mower County ransomware attack

Analyst assessment

Mower County, Minnesota, took most county systems offline after detecting ransomware on June 18, 2025. Our initial reporting described the interruption. The county’s final incident notice later established unauthorized network access between June 11 and June 18 and confirmed that attackers took county data.

Operational significance

The shutdown interrupted administrative systems and public access to county services. Administrator Matthew Verdick said the response included forensic work and a temporary non-emergency law-enforcement number, while 911, fire and emergency resources continued operating.

The sheriff’s original announcement reports regular phone service restored at 9 p.m. June 18. That component recovered before other systems. By June 26, inaccessible property records were delaying or halting real-estate closings. A local attorney and mortgage professional explained that participants could not safely establish title and lien priority through their normal searches. The report described records as inaccessible, not destroyed.

On July 22, commissioners acknowledged a negotiated payment intended to restore services and protect personal information. Although the county described the incident as resolved, the same report said system restoration remained in progress. August reporting described systems as largely back online. Operational disruption is presumed resolved; those statements do not supply an exact date when every affected service returned.

Confidence and uncertainty

Confidence is high in ransomware, disruption and theft because county statements and the final notice directly establish them. The later data findings supersede early uncertainty about whether information had been taken. Affected categories included identification, financial, health and biometric information, with the combination varying by person.

The county said its monitoring had found no indication that personal information was released or offered for sale. That finding does not establish deletion of stolen material or eliminate the consequences of the confirmed theft. Notification and data-review work continued after the service-recovery period.

Analytic gaps

No perpetrator, initial-access method or detailed encryption findings are established in the reviewed evidence. The payment amount and negotiation terms remain undisclosed, and the reported payment does not independently verify an attacker’s assurances about data. No matching ransomware.live claim was returned by the reviewed county-name and domain searches.

The exact full-restoration date, total recovery cost and independently reconciled affected-person count remain unknown. June 26 is the latest precisely dated report reviewed here that identifies a specific continuing service loss. Later general restoration, investigation and notification statements do not establish that property-record access or every other service remained unavailable throughout that period.