Winona County
bd_192fea38c147277e · schema v1 · pii pii-v1
Full breach record for Winona County →2 incidents on filePress / market disclosure — not a breach-notification filing
A media or market posting that confirms an incident but carries no breach-notification fields, so compliance clocks aren't assessable. The summary below is extracted from the coverage — verify against the source.
National Guard to assist Winona County following cyberattack. Winona County: Minnesota Governor Tim Walz has authorized the National Guard to provide emergency assistance to Winona County following a cyberattack that occurred on Monday, April 7, 2026. This attack, which extended into Tuesday, significantly hindered the county's ability to provide essential municipal and emergency services. Local authorities are collaborating with various agencies, including the FBI and cybersecurity experts, to secure operations, as the county had already suffered a ransomware attack in January. Linked ransomware group: interlock.
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Apr 6, 2026
Press report
—
Corroborated · see linked filings
This record's own dates cannot anchor compliance clocks; see the linked filings.
Attack → press
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Ransomware claims (1)
- Leak Siteinterlockbd_b4a4ad03d964689f2026-05-01 · +25dVerified
Regulatory filings (3) · sorted by filing gap
- Massachusetts State AGbd_30724b94e44bf2212026-10-01 · +178dCandidate
- Vermont State AGbd_4ef1c8616a85c0522026-10-08 · +185dVerified by operator
- New Hampshire State AGbd_ec2b73271f8aca002026-10-14 · +191dCandidate
Filing propagation · 3 filings · 3 states
View merged incident ↗Pattern: first filing Oct 1 (MA), last Oct 14 (NH) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- incident type + narrative only (may be machine-translated)
- discovery date
- materiality
- affected count
- data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
interlock
According to ransomware.live, Interlock is a ransomware group first observed in September 2024 that targets critical infrastructure sectors including healthcare, government, education, and technology across North America and Europe using double-extortion, with 57+ claimed victims including a major US dialysis provider exposing over two million patient records.