Winona County, Minn., Paid $128K Ransom to Restore Services - GovTech
Summary
Winona County, Minnesota, paid $128,000 to ransomware attackers to restore services after a January cyber attack. The payment was facilitated by the county's insurance carrier and completed to ensure a full and efficient resumption of services and the protection of personal information. The county made the decision after careful consideration and guidance from its cybersecurity team. The attack was first discovered on the county's computer network on January 22. People impacted by the attack were notified in May. A second ransomware attack targeting county networks was discovered in April and remains under investigation.
Key points
- The county paid $128,000 in ransom to restore services following a January cyber attack.
- The payment was made with the assistance of the county's insurance carrier.
- The first attack was discovered on January 22 and impacted numerous county systems.
- People affected by the first attack were notified in May.
- A second ransomware attack was discovered in April and remains under investigation.
- The county plans to notify affected individuals by letter and offer credit monitoring services.
- County officials have stated the second attack was 'separate and unrelated' to the first.
Timeline
The first ransomware attack was discovered on the county's computer network.
People impacted by the January attack were notified.
A second ransomware attack targeting county networks was discovered.
“Although making the payment in connection with the January incident was a difficult choice, we determined it was the necessary approach to best serve the interests of Winona County residents and employees.”
Background
The county has invested in the security of its digital data and computer network.
Why it matters
The incidents highlight that sophisticated criminal actors continue to pose an on-going threat to all computer network systems.
What's next
The county is continuing to review data to determine what information may have been compromised and who was affected.