Officials notify possible victims of cyberattack impacting 17 Minnesota counties
Authorities say a cyberattack last fall affected an electronic document management system used by 17 Minnesota counties, possibly compromising the personal information of many Minnesotans.
The ransomware attack impacted 15 counties in west and northwest Minnesota — ranging from Stevens County north through Kittson County in the state’s far northwestern corner — plus Isanti and Scott counties and a system in Pope County, which all share a system called CaseWorks, according to Clay County. Clay County says it first discovered the attack on Oct. 27, 2023.
The county says it sent out a notice on Dec. 22, 2023 to people who may have been impacted by the breach and is now notifying additional individuals who currently or used to receive social services from any of the affected counties.
State and federal officials have been notified, according to Clay County, which added that it initiated its incident response process as soon as the attack was discovered.
“Through the investigation, Clay County determined that there was unauthorized access to its network between October 23, 2023 and October 26, 2023, and that the cyber criminals responsible for this attack took some data belonging to certain county social service entities from Clay County’s network,” the county said in a news release on Friday.
The county goes on to say that the affected data may have included names, Social Security numbers, addresses, birth dates, and information about services provided by social services, possibly including client identification numbers and insurance and billing information.
“For some individuals, the information may also have included financial account information, driver’s license number, state identification number, government identification number, immigration or tribal identification number, individual taxpayer identification number, physician or medical facility information, medical record number and/or information related to a medical diagnosis, condition and/or treatment,” Clay County says.
Authorities are urging anyone who may have been impacted by the breach to be proactive in protecting their personal information and also to closely monitor for any signs of fraud. Anyone who sees something suspicious is urged to contact local law enforcement immediately.
Clay County had previously notified the public in December that it and six other counties, as well as a health system in Pope County, had been impacted by this cyberattack.
Below is the full list of known entities affected by the cyberattack, according to both December’s news release from Clay County and Friday’s news release:
- Clay County Social Services
- Big Stone County Family Services
- Pennington County Human Services
- Otter Tail County Human Services
- Becker County Human Services
- Isanti County Health and Human Services Division
- Marshall County Social Services
- Roseau County Social Services
- Kittson County Social Services
- Mahnomen County Social Services
- Red Lake County Social Services
- Polk County, Minn., Social Services.
- Pennington County Human Services
- Scott County Health and Human Services
- Stevens County Human Services
- Traverse County Social Services
- Western Prairie Human Services in Glenwood
- Wilkin County Health & Human Services