Winona County’s main IT system is still down as of Friday, but it’s bringing individual systems back online in a phased approach following a cyberattack to its network Tuesday.
Ben Klinger, Winona County Emergency Management Director, told reporters Friday morning that county operations remain open and staffed, but some services are slower than normal. As systems are verified and deemed secure, they’ll gradually come back online.
“We train and plan for situations like this, and those plans are working,” Klinger said. “Early in the incident, we made the decision to take parts of our network offline to contain the threat. The step was necessary to protect our systems, even though it created a disruption. While technology is a major part of how we operate, it is not the only way we operate. The work of Winona County continues with or without computers.”
Klinger said a lot of county processes are currently being done with pen and paper. However, services within the Department of Motor Vehicles and Vital Statistics are currently unavailable. The DMV, for example, requires an internet connection with the state to operate. If there’s an immediate need from these departments, Klinger said residents can go to neighboring counties for assistance.
Emergency services have been operating without disruption since the cyberattack began Tuesday.
The county is being supported on site by the Minnesota National Guard cyber protection team and is also receiving assistance from third-party cyber security and data forensics teams. At the county level, Klinger said its IT staff have been “working around the clock since this began.”
“This is detailed, methodical work — identifying affected systems, securing the network and restoring operations safely,” Klinger said. “Progress is being made.”
This is the second time Winona County has experienced a cyberattack already this year. Klinger said the systems were restored after the January attack, but that investigation is still ongoing. He said the attacks appear to have been committed by different cybercriminals.
Klinger addressed the question he said many are asking at the press conference: How does something like this happening again?
“The reality is cyberattacks are not unique to Winona County,” Klinger said. “They are happening across the country — to governments, hospitals, schools and private businesses. They are complex and evolving events. What matters is how we respond. And I can tell you this, the people working on this, from our local staff to state and federal partners, are committed to seeing this through.”
According to the state’s 2025 Cybersecurity Incident Report, attacks against federal, state, and local governments are rising in frequency and sophistication. In recent years, the city of St. Paul and Rochester Public Schools have been targets of attacks. The report indicates that 269 public entities and government contractors in Minnesota reported possible cybersecurity incidents last year.
“Cyber attackers have gotten really good at hacking humans,” said John Israel, the state of Minnesota’s chief information security officer. “They're finding ways to really trick people. They've turned this into a business operation with very mature teams that are focused on finding vulnerabilities, exploiting them and getting to the maximum impact that they can.”
Israel said that these criminal agents are financially motivated and relentless. They’re generally focused on encrypting and locking down IT systems and stealing data that they can hold hostage – threatening release if the organization doesn’t pay the ransom. Israel said the perpetrators are often part of overseas groups.
Klinger said because the investigation is ongoing, authorities cannot say if the hackers accessed county residents’ personal or financial information nor if the cybercriminals are demanding a ransom.
“We do not want to release any of that type of information [that could] jeopardize the investigation,” Klinger said in an email to MPR News. “Our goal is to hold the criminals accountable.”
In the meantime, Klinger said Winona County is working to strengthen the security of its networks and build even more firewalls into its system to prevent future attacks.
Klinger said he doesn’t yet have a sense for when the attack will be completely resolved, but he’s hoping to know more by next week.
