On Monday, April 6, a cyberattack knocked out critical systems at Winona County, Minnesota, a county of about 50,000 people along the Mississippi River. By the next day, the situation was bad enough that Gov. Tim Walz signed an executive order activating the Minnesota National Guard's cyber protection support.
According to the governor's office, the attack significantly impaired the county's ability to provide emergency and municipal services. The county asked for help because of the scale and complexity of what it was facing. The Guard joined Minnesota IT Services, the state Bureau of Criminal Apprehension, the League of Minnesota Cities, the FBI and private cybersecurity experts in the response.
"Cyberattacks are an evolving threat that can strike anywhere, at any time," Walz said. "Swift coordination between state and local experts matters in these moments."
As of this writing, officials hadn't said publicly what type of attack it was, who was behind it or whether data was taken. Those details will come. The lesson is already clear.
Not a big-city problem
When people picture a government cyberattack, they often think of large cities like Atlanta or Baltimore. Winona County is a reminder that attackers don't screen for size. A small county with a lean IT team runs the same essential services as a big one: 911 dispatch, jail management, property records, courts, payroll and elections. It just has far fewer people to defend them.
The FBI sees the same pattern. When the Bureau's Internet Crime Complaint Center released its 2025 report on April 7, a day after the Winona attack began, Taushiana Bright, a section chief in the FBI's Cyber Division, didn't mince words about ransomware gangs. "I can't think of anything that's off limits to them," she said. "Cybercriminals have indiscriminately attacked hospitals, emergency responders, schools and entire city governments."
The hardest day to plan is the first one
Most of the damage in an incident like this happens in the first 48 hours. Who decides to shut down the network? Who calls the state? How do dispatchers take calls if the CAD system is down? Where are the phone numbers when Outlook won't open?
Agencies that have worked through those questions ahead of time recover faster and spend less. Agencies that haven't end up making big decisions under enormous pressure, often with incomplete information.
Here in Florida, the law already sets some of those expectations. Since 2022, local governments have been required to report ransomware incidents to the state within 12 hours of discovery and to have cybersecurity standards aligned with the NIST framework. That 12-hour clock is easy to miss when your systems are on fire, which is exactly why it belongs in a written plan.
Five things to do this month
You don't need to wait for budget season to act on this. These steps cost mostly staff time.
Write down who does what. A one- or two-page incident response plan should name the person who can authorize shutting systems down, who contacts the Florida Digital Service and law enforcement, who talks to the public and who calls your cyber insurance carrier. Include backups for each role.
Print it. Keep paper copies of the plan, key phone numbers and vendor contacts in a few places, including off-site. If your network is down, a plan stored on the file server is no help.
Run a tabletop exercise. Gather department heads for 90 minutes and walk through a scenario like Winona's: systems are down, the phones are ringing and the press is calling. You'll find gaps quickly. Most agencies do.
Check your backups the hard way. Ask your IT team or provider when they last restored a critical system from backup, end to end. Make sure at least one copy is offline or immutable so ransomware can't reach it.
Know who you'd call for help. Winona County leaned on state agencies, a cities league, the FBI and private experts. Figure out now who those would be for you, and whether you have a retainer or contract in place so you aren't negotiating terms in the middle of an emergency.
Plan for the services, not just the servers
One detail from Winona stands out: the concern was the county's ability to provide emergency and municipal services. That's the right lens. Residents don't care which server went down. They care whether 911 answers, whether the clerk can record a deed and whether employees get paid.
Ask each department head a simple question: if every computer in your office went dark tomorrow morning, how would you keep working for a week? The answers will tell you where your real risks are.
Where vTECH io fits
vTECH io works with Florida counties, municipalities and sheriff's offices on incident response planning, tabletop exercises, backup and recovery, and the security tools that help stop an attack before it spreads. If Winona County's story made you wonder how ready your organization is, we'd be glad to help you find out. Call us at 888-277-5918.
Sources
- Walz activates National Guard to aid Winona County after cyberattack, Northern News Now, April 7, 2026
- FBI slams cybercriminals for attacking schools, hospitals as crypto fraud soars, TechRadar, April 2026
- HB 1085 (2026) Bill Analysis, including current local government incident reporting requirements, The Florida Senate