Minnesota governor orders emergency support for cyberattack disrupting county’s ‘critical systems’

Minnesota Gov. Tim Walz on Tuesday issued an emergency executive order lending the assistance of the state’s National Guard to Winona County, which is facing a cyberattack disrupting its “critical systems and digital services.”

According to the order, the county has been “working around the clock” since discovering the cyberattack on Monday. According to a press release from the governor’s office, the cyberattack is “significantly impairing the county’s ability to deliver vital emergency and municipal services.” (The office did not respond to an email asking which services are affected. When a reporter called Winona’s police department, a phone operator said she was unable to transfer him to the person who could provide more information, because “that’s one of the systems that’s down.”)

Walz’s order notes that the county, a region of some 50,000 residents at the southeastern edge of the state, is working with FBI, a cybersecurity vendor, the state’s IT agency, the Minnesota Bureau of Criminal Apprehension and the League of Minnesota Cities, a membership association that promotes “excellence in local government.”

“Unfortunately, the scale and complexity of this incident has exceeded both internal and commercial response capabilities,” the order reads. “As a result, Winona County has requested cyber protection support from the Minnesota National Guard to help address this incident and make sure that vital municipal services continue without interruption.” The governor observes in his press release that “cyberattacks are an evolving threat that can strike anywhere, at any time. Swift coordination between state and local experts matters in these moments.”

Walz’ order authorizes the state’s adjutant general to organize “the personnel, equipment, facilities, and resources needed to provide assistance throughout Minnesota” and “to procure the goods and services needed to accomplish the mission,” using state general funds, “until the emergency conditions caused by the cyberattack subside or until it is rescinded by proper authority.”

Monday’s incident marks the second successful cyberattack against Winona County this year. County Administrator Maureen Holte issued a statement in February noting that the county had finished recovering from a cyberattack initiated the previous month. The January incident had disabled numerous systems, including those required to close real-estate transactions and to access police files, such as incident reports and dash-cam footage. “Everything is operational,” she told the Winona Post on Feb. 24.

Several days earlier, Holte had notified the public of the county’s “phased approach” to bringing public services back online, and asked for patience: “We still encourage you to call the county office that you have business with before visiting in person to make sure they will be able to help you. We are committed to minimizing the impact on residents doing business with the county.”