MalwareGovernmentGovernmentRansomwareData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumContained

Winona County

bd_ec2b73271f8aca00 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Apr 7, 2026

Filed

Oct 14, 2026

To disclose

27 weeks

Affected

5state residents only

Linked

5 records

Confidence

70%

Full breach record for Winona County →2 incidents on file

Winona County, Minnesota experienced a ransomware incident where cyber criminals accessed its network between March 13 and April 7, 2026, copying data including names, Social Security numbers, and driver's license numbers. The County detected the ransomware on April 7, 2026. Five New Hampshire residents were affected. The County engaged third-party forensic consultants, notified law enforcement, secured its network, and is offering credit monitoring services.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d27 weeks discovery → filing

Incident timeline

undetected · 25 days

discovery → filing · 27 weeks / 190 days

Mar 13, 2026

Begins

Apr 7, 2026

Discovered

Oct 14, 2026

Filed

This filing is one of 5 records about the same incident.View merged incident

A leak claim by interlock about this victim was first seen 166 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteinterlockbd_b4a4ad03d964689f2026-05-01 · +166dVerified

Regulatory filings (2) · sorted by filing gap

Vermont State AGbd_4ef1c8616a85c0522026-10-08 · +6dVerified by operator
Massachusetts State AGbd_30724b94e44bf2212026-10-01 · +13dCandidate

Press reports (1)

Pressinterlockbd_192fea38c147277e2026-04-06 · +191dVerified by operator

Name: Winona County
norm: winona county
Domain: winonacounty.gov

Name: Winona County
norm: winona county
Domain: winonacounty.gov
Industry: Governmentllm

Discovered: Apr 7, 2026
Breach occurred: Mar 13, 2026 – Apr 7, 2026
Undetected for: 25 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 8, 2026
Affected individuals: 5state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcementNotified appropriate Minnesota state agenciesFiled notice with New Hampshire Attorney General

During the incident: Launched an investigation with assistance from nationally recognized third-party cybersecurity and data forensics consultants
Notified federal law enforcement and the appropriate Minnesota state agencies
Secured its network
Conducted a thorough review to determine what information was involved, who may have been affected, and where those individuals reside
Offering one-year complimentary membership with IDX for credit monitoring and identity theft services
Changes made: Deployed security tools to enhance detection and accelerate response to cyber incidents
Actively monitoring its network using end point detection tools to help ensure containment
Conducting an enterprise-wide password reset
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 weeks(190 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGOct 1 · first

Vermont State AG+7d

New Hampshire State AG+13d · this page

Pattern: first filing Oct 1 (MA), last Oct 14 (NH) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/winona-county-minnesota-20261014.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 14, 2026
Raw hash: ddbcf74e8d614629aa4dc4a2c9c3495abd18ac2ff9e09fd0665479bcecbc1b7c

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Press reports (1)

Reporting entityWinona County

Victim entityWinona County

Incidentdiscovered Apr 7, 2026

Stated responseLaunched an investigation with assistance from nationally recognized third-party cybersecurity and data forensics consultants

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov