Winona County experienced an external system breach (hacking), identified as a ransomware attack with data theft, between January 18 and January 22, 2026. The county discovered the breach on April 16, 2026. The incident was disclosed to the Maine Attorney General on May 12, 2026.
The breach involved names or other personal identifiers in combination with unspecified sensitive data. A total of 6,196 individuals were affected nationwide, including at least one resident in Maine. The specific types of data exposed beyond names and personal identifiers have not been fully itemized in public sources, including whether SSN, medical, or financial data were compromised. Written notices were sent to affected consumers on May 12, 2026, and identity theft protection services were offered for 12 months through IDX.
Details about which other data types were involved may emerge as more information becomes available, and consumer notices may be delayed.