National Guard Cyber Units Aid Ransomware Response in Multiple States

Minnesota called in its National Guard last month after a ransomware attack struck Winona County. The county had experienced a prior cyberattack three months earlier. Officials authorized the state's National Guard cyber protection team to support incident response efforts and ensure continuity of municipal operations.

The April 6 attack caused significant disruptions and impaired the county's ability to provide vital emergency and critical services, according to the governor. Local personnel and commercial cybersecurity firms could not contain the incident. The FBI is investigating the attack, though its role does not include system recovery and rebuilding.

As a result, the Minnesota National Guard deployed 15 soldiers from its cyber protection team. This marked the second such cyber response by the unit in less than a year. In July of the previous year, the team assisted St. Paul after a cyberattack that shut down first responders' dispatch systems for ambulances, police vehicles and firetrucks.

Those systems remained offline for a week. Recovery took months even with National Guard support. The National Guard's resources and qualifications have enabled similar assistance in other states.

In 2019, a large-scale ransomware attack hit 54 schools in Louisiana. After a state of emergency was declared, the Louisiana National Guard's cyber team responded and recovered the school systems within two weeks. The effort also mitigated attacks on additional schools across the state.

One month later, 22 counties in Texas were affected by a ransomware incident that disrupted local services and financial operations. Problems included utility payments and access to birth and death certificates. The mayor of one affected city stated that just about everything at city hall was impacted.