Winona County Enlists National Guard, BCA After Second Cyberattack

County officials work to restore systems and bolster network security following ransomware incident.

Apr. 11, 2026 at 12:05am

Got story updates? Submit your updates here. ›

An extreme close-up photograph of a corrupted computer hard drive with a glowing red LED light, conveying the stark, gritty, and investigative nature of a ransomware attack on a local government's computer systems.A cybersecurity attack on Winona County's network exposes the growing threat of ransomware targeting local governments.Rochester Today

Winona County, Minnesota has enlisted the help of the National Guard and Bureau of Criminal Apprehension (BCA) after a second cyberattack hit the county's network. Officials have taken parts of the network offline to investigate and restore security, with the DMV, vital statistics, and main county systems still down as of Friday. The county is working to strengthen its network to prevent future attacks, with the National Guard assisting in identifying vulnerabilities.

Why it matters

Cyberattacks on local governments are on the rise, with hackers often financially motivated to gain access to networks and data. This incident in Winona County highlights the growing threat and the need for robust cybersecurity measures, especially for critical public services like DMVs and vital records.

The details

Winona County's emergency management director, Ben Klinger, said staff took part of the county's network offline 'out of an abundance of caution' following the ransomware attack. The county is working to restore its systems in phases, verifying each one's security before bringing it back online. Klinger did not comment on the origins or extent of the attack, but said it is separate from a previous incident in January. The National Guard's cyber coordination cell director, Lt. Col. Brian Morgan, explained how hackers typically try to gain access to networks and then demand a ransom to restore availability or threaten to release extracted data.

  • The latest cyberattack on Winona County's network occurred on Tuesday, April 11, 2026.
  • A previous cyberattack on the county's network happened in January 2026.

The players

Ben Klinger

Winona County's emergency management director, who provided details on the county's response to the cyberattack.

Lt. Col. Brian Morgan

The cyber coordination cell director for the Minnesota National Guard, who explained the tactics used by hackers in these types of attacks.

Minnesota National Guard

The state's National Guard has become involved in the investigation and is helping the county identify vulnerabilities in its network.

Bureau of Criminal Apprehension (BCA)

The Minnesota state law enforcement agency that has also joined the investigation into the cyberattack on Winona County.

Got photos? Submit your photos here. ›

What they’re saying

“The [cyberattacks] are complex and evolving events. The people working on this, from our local staff to state and federal partners are committed to seeing this through. They are not going to stop until we have answers and our systems are fully restored.”

— Ben Klinger, Winona County Emergency Management Director

“Cyberattacks on local governments are on the rise due to the fact that these threat actors are typically financially motivated.”

— Lt. Col. Brian Morgan, Cyber Coordination Cell Director, Minnesota National Guard

“If they're able to [gain access to the network], then they'll try and extort that data and ask for money not to release that data to the world.”

— Lt. Col. Brian Morgan, Cyber Coordination Cell Director, Minnesota National Guard

What’s next

The National Guard and BCA will continue to assist Winona County in investigating the cyberattack and hardening its network security. The county is working to restore its systems in a phased approach, verifying each one's security before bringing it back online.

The takeaway

This incident in Winona County underscores the growing threat of cyberattacks targeting local governments, which are often financially motivated and aim to disrupt critical public services. The county's response, with the help of state and federal partners, highlights the importance of robust cybersecurity measures and the need for ongoing vigilance against evolving cyber threats.