WINONA County, Minnesota, paid $128,539.57 following a ransomware attack detected on January 22, 2026. This payment was negotiated with the help of the county's insurance carrier to ensure the resumption of services and protect personal information. Investigations were launched in collaboration with third-party forensic experts and federal law enforcement, and affected individuals were notified on May 12.
A second, unrelated ransomware attack occurred on April 7, with the hackers from this attack, identified as InterLock, later leaking data on the dark web. The identity of the January attackers remains unknown.