Winona County January 2026 ransomware incident

Analyst assessment

DysruptionHub assesses with high confidence that Winona County experienced a ransomware incident involving network disruption, unauthorized access and data theft in January 2026. The county’s initial statement said it had identified ransomware affecting its computer network and was testing systems with cybersecurity, forensics and law-enforcement assistance. Its later data-security notice established that unauthorized access occurred from Jan. 18 through Jan. 22, when the county detected the ransomware, and that the intruders took data from the network.

Ransomware involvement and data theft are confirmed by the affected organization rather than inferred from the outage pattern. Our reporting and the county’s disclosures provide the evidence base; this record’s assessment is a separate CTI judgment. The public record does not identify the ransomware family, initial access vector, threat actor, ransom demand, payment status or the method used to remove data.

Operational significance

The incident affected the administration of a county government serving residents across Winona County. DysruptionHub’s Jan. 23 report said many county phone lines and some internal networks were unavailable, a sheriff’s office media briefing and at least one virtual meeting were canceled, and deputies could not use police-records software. Emergency services, including 911 and fire response, remained operational, limiting the documented public-safety impact.

The county declared a local emergency and implemented business-continuity measures. A Feb. 12 update reported by KTTC said some systems remained offline and county services could be delayed while restoration continued.

Retrospective note

The county later said it securely restored the network and completed its review of affected information on April 16. It began mailing notices May 12. A Maine Attorney General filing reports that 6,196 people were affected and offered 12 months of IDX monitoring, identity-restoration assistance and insurance.

The county expressly distinguished this event from a separate April 2026 ransomware attack. The two incidents affected the same government less than three months apart, but the county’s preliminary investigation said different cybercriminals were responsible, and no later public evidence establishes a shared access path, actor or campaign.

Confidence and uncertainty

Confidence is high that malicious cyber activity caused the disruption because Winona County directly identified ransomware and later confirmed unauthorized access and data removal. Confidence is also high that 6,196 people were affected, based on the regulatory filing submitted by county counsel.

The affected information varied by person and included names, addresses, Social Security numbers, driver’s license or state identification numbers, medical information, law-enforcement-report information, financial account information and PMI numbers. For a smaller group, payment-card details or online account credentials were also affected. The public record does not establish whether all categories were taken from a single system or how broadly each category was exposed.

Analytic gaps

The reviewed public sources do not establish the initial access vector, exploited vulnerability, compromised account or host, dwell time before Jan. 18, malware family, encryption scope, lateral movement, persistence, ransom demand, payment, threat actor, exfiltration method or exact date on which every county system and service returned to normal. They also do not establish a technical or organizational connection between the January and April attacks beyond the shared victim.