Minnesota ordered National Guard cyber assistance for Winona County, based in Winona, after a cyberattack disrupted county systems for a second day and impaired emergency and municipal services.
Gov. Tim Walz on Tuesday signed an executive order authorizing the Minnesota National Guard to provide cyber protection support to Winona County after a cyberattack that began Monday, April 6, disrupted critical systems and digital services and continued into Tuesday. The order said the incident significantly impaired the county’s ability to provide vital emergency and critical services.
The order said county officials were coordinating with Minnesota IT Services, the Minnesota Bureau of Criminal Apprehension, the League of Minnesota Cities, the FBI and an external cybersecurity vendor, but that the scale and complexity of the incident had exceeded internal and commercial response capabilities. The order took effect immediately and remains in force until the emergency conditions subside or it is rescinded.
Winona County’s emergency order follows the last publicly documented Minnesota case in which the National Guard was mobilized for a local cyber incident: St. Paul’s July 2025 attack, which disrupted city services and prompted what a Guard spokesperson said was the first in-state deployment of Minnesota Guard cyber forces.
Chip in once
If this reporting helped you, a one-time tip helps cover hosting, tools and future investigations.
Support us monthly
A small monthly pledge keeps independent coverage and our reader tools online for everyone.
The incident is the second publicly disclosed cyber event to hit Winona County this year. In January, the county said it had identified a ransomware attack affecting its computer network, declared a local emergency and brought in outside forensics experts and law enforcement, while saying 911, fire and emergency response operations remained operational.
County officials have not publicly said which systems were taken offline, whether any data was accessed or stolen, or who may have been behind the latest attack. Because state and county statements describe the incident only as a cyberattack, DysruptionHub is not characterizing it as ransomware. No public claim of responsibility had surfaced as of publication, and Winona County did not respond to an emailed request for comment from DysruptionHub.
By Feb. 12, after the earlier incident, county officials said some services still faced delays as systems were restored in phases and departments relied on workarounds. The county also said it remained unknown whether residents’ personal information had been affected, and no group had publicly claimed responsibility as of publication.
Winona County, in southeastern Minnesota along the Mississippi River, had an estimated 49,973 residents as of July 2024, giving readers a sense of the scale of the local government now operating under emergency cyber assistance.
The next phase is likely to center on system restoration and forensic review. For the public, the main unanswered questions are which county services remain disrupted, whether any public-safety functions are operating on backup procedures, and whether officials will issue a separate notice if investigators confirm data exposure.
