After Cyberattack, Rural Washburn County Upping Security

Source:Colin (CC BY-SA 4.0)

Far-northern Washburn County will spend thousands on top-level cybersecurity monitoring months after an attack took the county government’s entire network down.

The attack, which happened in August, is only one of multiple cyberattacks that have hit Wisconsin cities, counties and organizations in the last two years.

“It’s something that, in our day and age, with technology out there — the bad actors out there are not going to stop,” Washburn County Board Chair Lolita Olson said.

Washburn County staff first discovered the attack early on the morning of Aug. 6, Olson told WPR shortly after the attack. Staff started response procedures and took steps to protect county systems and data.

The attack came in the middle of nationwide reports that roughly a dozen states experienced cyberattacks on wastewater and water utility operations. Olson said it doesn’t appear those incidents and Washburn’s attack were linked.

Nearly three months later, Washburn County has taken significant steps to upgrade its digital security.

The county has decided to put “high-end security” and monitoring systems in place to protect county tech, according to a justification form for the expenses. These include 24/7 monitoring of the county’s tech operations and ways to handle future attacks.

“It’s just another repertoire for emergency response,” Olson said. “You never think it’s going to happen to you, but be prepared because it will.”

However, an undisclosed number of people had their data breached, according to Olson. The attack cost the county over $30,000 and the new protections are another expense for a county with a population of roughly 16,000 people.

Across Wisconsin, ransomware attacks are targeting data

The Washburn cyberattack wasn’t a unique incident. Multiple communities and counties and even school districts have faced targeted cyberattacks across Wisconsin over the past few years.

In late September, Stevens Point found someone had accessed municipal servers without authorization. Staff quarantined the affected devices, and said no citizen or employee data was stolen.

Earlier this year, Rusk County was hit by a cyberattack affecting its network and personal information was potentially accessed.

In 2025, Iowa County was hit in a ransomware attack, disrupting multiple systems and real estate sales. Investigators found the attacker “intentionally deleted a significant portion of the County’s network.”

In 2024, Sheboygan was hit by a cyberattack that disrupted the city’s network and potential data theft affected over 67,000 people.

Washburn hires security, works to help people affected

After the attack was detected, Olson said the county staff jumped directly into action. She added that the attack did not start with any employee clicking or interacting with a computer program.

“All our backups were good,” Olson said. “We had unplugged everything right away, and that limited how far in the bad guys could go.”

Bjoertvedt (CC BY-SA 3.0)

Beyond the hard reboots and other measures they took on county machines, Olson said they quickly brought in an expert cybersecurity team to help.

“Any suggestions they gave to our IT team, they had already taken care of it,” she said.

Washburn County also launched a forensic investigation, which found certain data was stolen from the county’s system during the attack — including some people’s personal information, according to Olson.

Olson declined to comment on the number of people affected, but said the county was providing them extended credit monitoring.

“All I can say at this point is that there was minimal effect to the general public in Washburn County or the employees,” Olson told WPR. The county notified affected people individually.

But, the attack did cause some financial impacts to the small county, according to discussion and documents in a September meeting.

The estimated cost of the attack was at least $59,898, Olson said. Through their insurance, Washburn County had a $25,000 deductible — and the total cost covered was roughly $34,898.

Tech experts and county officials have also been reviewing the security of the network after the attack.

“The network is secure,” Olson said in the meeting. “We wiped and rebuilt affected systems and have taken steps to bolster our network security.”

But, why Washburn was targeted is still unclear, according to county officials.

“I think it’s just luck of the draw,” Olson said.

According to records from the October meeting of the board, the county’s new cybersecurity programs come from RMS, a cybersecurity vendor, which stepped in to assist the county after the attack. It includes all server, workstation and firewall monitoring systems — and despite costing $6,500 a month it’s still more affordable than other options.

“Washburn County is only 16,000 or 17,000 folks,” Olson said. “So to hire an additional three or more people to do this 24/7 monitoring is just not cost-effective.”

After cyberattack, rural Washburn County is upping security was originally published by Wisconsin Public Radio.