Carlton County's 2025 Data Breach: 3,502 People, Compromised Email Mailbox — and Questions Still Unanswered
by Carlton County Watch
In early 2025, an unauthorized actor gained access to a Carlton County employee's email account.
What happened next affected thousands of people, exposed extraordinarily sensitive personal information, prompted a federal investigation, preceded the termination of Carlton County's longtime Information Technology Director, and occurred against the backdrop of a computer-risk-management deficiency that County auditors trace back nearly two decades.
More than a year later, important questions remain.
What exactly was downloaded?
What County information was contained in the compromised mailbox?
Why was the County's Information Technology Director terminated?
What was discussed behind closed doors immediately before the County Board voted to terminate him?
What did Carlton County's forensic investigation conclude?
And what changes have been made to ensure that residents' information is secure today?
Carlton County Watch intends to find out.
This article is the beginning of what may become a continuing series as additional public data become available.
What We Know About the Breach
Carlton County publicly disclosed the incident on April 25, 2025.
According to the County's own notice, it was discovered on February 6 that an employee's email account had sent spam messages. The County then engaged a digital-forensics firm to investigate.
That investigation determined that an unauthorized actor had accessed the employee's email account between January 23 and February 6, 2025 and that the contents of the mailbox had been downloaded. The County’s webpage linking this data has been shutdown.
That last fact deserves attention.
This wasn't merely an unsuccessful phishing attempt or someone temporarily viewing an inbox. According to Carlton County, the contents of the compromised mailbox were downloaded.
The County says it completed its review of the affected emails on April 10 and began notifying affected individuals on April 25. The County’s webpage linking this data has been shutdown.
The U.S. Department of Health and Human Services Office for Civil Rights identifies the Carlton County incident as a "Hacking/IT Incident," lists email as the location of the breached information, and reports that 3,502 individuals were affected. Webpage now unavailable.
The information potentially exposed was exceptionally sensitive.
Carlton County reported that the mailbox contained information that could include names, addresses, Social Security numbers, driver's-license numbers, dates of birth, financial-account numbers, online usernames and passwords, medical conditions, diagnoses, medications, healthcare-provider information, medical-record numbers, insurance identifiers and information concerning services received through Carlton County HHS. The County’s webpage linking this data has been shutdown.
The County said at the time that it was not aware of misuse of the compromised information. The County’s webpage linking this data has been shutdown.
One Compromised Account Does Not Necessarily Mean One Department's Data
What was inside that mailbox?
Government employees do not necessarily communicate exclusively within their own departments. An HHS mailbox could potentially contain correspondence involving other County departments, outside agencies, attorneys, medical providers, law enforcement, contractors or members of the public.
The fact that only one account was reportedly compromised therefore does not, by itself, tell the public the organizational breadth of the information contained within the downloaded mailbox.
That is one of the questions Carlton County Watch intends to pursue through public-data requests.
Then the IT Director Was Terminated
Four months after the County discovered the breach, something significant happened.
On June 10, 2025, the Carlton County Board of Commissioners voted to enter a closed session.
The official minutes state that the regular meeting was closed under Minnesota Statutes §13D.05 "related to attorney-client privilege."
The commissioners subsequently returned to open session.
The employee was longtime Carlton County IT Director Peter Gould.
The public minutes do not disclose what was discussed during that closed session.
Later reporting by the Pine Knot revealed that Gould's termination letter cited the data breach among the reasons for his dismissal. According to the quoted termination letter, the County contended that the incident had been exacerbated by inadequate IT protocols for responding to employee reports of phishing attempts. Gould disputed the County's characterization.
Gould's attorney separately alleged that his termination was retaliatory and disputed the County's criticism of his work. Those are allegations made by Gould and his attorney, not established factual findings.
The County and Gould subsequently entered into a $90,000 settlement agreement approved by the County Board on July 8 to resolve issues connected with his former employment.
That sequence leaves an obvious public-interest question:
What did the County learn about the breach that led it to hold the IT Director responsible?
And another:
What was discussed during the attorney-client closed session immediately before the public vote terminating him?
The Board did vote publicly. But the reasoning discussed privately before that vote is not explained by the Board minutes.
A Cybersecurity Finding Dating Back to 2006
There is another piece of this story that deserves much greater public attention.
Carlton County's most recent State Auditor management letter identifies a finding entitled "Computer Risk Management."
Its stated year of origination is 2006.
The auditor warned that County management and governance could be unprepared to respond to unanticipated risks in a timely and effective manner.
The audit established that computer-risk management had been an identified County governance issue long before the 2025 cyber incident.
That raises a broader question about responsibility.
If computer-risk management had been identified as a County issue dating back to 2006, what responsibility rested with the IT Director, what responsibility rested with County administration and the Board, and what corrective measures had actually been implemented before the breach occurred?
Those questions require documents, not speculation.
Minnesota Law Requires More Than a Press Release
Minnesota's Data Practices Act contains specific requirements for government data breaches.
Minn. Stat. §13.055 provides that, after a breach investigation has been completed and applicable disciplinary proceedings have reached final disposition, the responsible authority must prepare a report on the facts and results of the investigation.
The law also requires Minnesota government entities to conduct, at least annually, a comprehensive security assessment of personal information they maintain.
Those provisions lead to several records Carlton County Watch intends to pursue.
We want to know whether Carlton County's §13.055 investigation report has been completed and, if so, what it says.
We want to know what cybersecurity assessments the County conducted before and after the breach.
We want to know what the outside forensic investigators concluded.
And we want to know which recommendations were made, which were implemented and which remain outstanding.
And What About Former County Attorney Lauri Ketola?
There is another event in the timeline that Carlton County Watch believes warrants inquiry.
On July 2, 2025, less than a month after Gould's termination, Carlton County Attorney Lauri Ketola announced that she would resign, effective September 29, leaving approximately 13 months before the November 2026 election.
Why?
The proximity in timing is notable.
It is not evidence that the two events were connected.
But asking whether any connection existed is a legitimate records question.
Was any complaint, cybersecurity investigation or other inquiry involving the County Attorney's Office pending when Ketola announced her resignation?
Did Ketola participate in or provide legal advice concerning the County's response to the breach or Gould's employment?
Who provided legal advice to commissioners before the June 10 closed session and termination vote?
Were any County Attorney communications contained within the compromised HHS mailbox?
And was Ketola's departure entirely unrelated to these events?
At this point, we do not know.
The appropriate response is not to assume an answer. It is to seek the underlying government data.
What We Still Don't Know
For all that has been publicly disclosed, several fundamental questions remain unresolved: exactly what records and communications were contained within the downloaded mailbox; whether information originating in other County departments was among those records; what the complete forensic investigation concluded; why the County determined that Gould should be terminated; what County management and commissioners knew about longstanding cybersecurity risks; whether the statutorily contemplated breach-investigation report has been completed; and what cybersecurity vulnerabilities, if any, remain outstanding today.
Carlton County Watch will be requesting records aimed at answering those questions.
We will also be seeking information concerning the County's cybersecurity assessments, outside consultants, policies, breach-response procedures and the documentary basis supporting personnel actions arising from the incident.
This Is a Beginning, Not a Conclusion
A breach affecting 3,502 people is significant.
A breach involving Social Security numbers, financial data, credentials and protected medical information deserves scrutiny.
So does the termination of the County's longtime technology director only months later.
And a computer-risk-management issue formally identified as originating in 2006 deserves examination when a serious cybersecurity event ultimately occurs years later.
But unanswered questions should remain questions until the evidence answers them.
Carlton County Watch will continue requesting public data, reviewing County records and reporting what those records actually show.
If the evidence ultimately establishes that the 2025 breach was narrowly confined and appropriately handled, readers should know that.
If the records reveal broader failures or additional accountability issues, readers should know that too.
The public's personal information was compromised. The public deserves to understand what happened, why it happened, how Carlton County responded — and what has been done to prevent it from happening again.