Cybersecurity Incident Reporting

The Minnesota Legislature amended Minnesota Statutes 16E.36 in 2024 to require MNIT and the BCA to establish a cybersecurity incident reporting system that accepts the submission of timely, secure, and confidential cybersecurity reports from public agencies, government contractors, and private entities.

The law requires public agencies – state agencies, local governments, public education entities – to report cybersecurity incidents that impact the public agency beginning Dec. 1, 2024. If a cybersecurity incident impacts a public agency, government contractors or vendors that provide goods or services must report the incident to the impacted entity, but they can also use the form.

Public agencies and government contractors that are required to report to MNIT and the BCA, under Minnesota Statutes 16E.36, include: 

• Cities
• Counties
• Government contractors or vendors that perform work for or on behalf of a public agency with access to or hosting the public agency’s network, systems, applications, or information if impacting data belonging to a public entity
• Higher Education (Post-Secondary)
• K-12 school districts, charter schools, intermediate districts, and cooperative school units
• Law enforcement agencies
• State agencies
• Townships
• Other

Reporting a cybersecurity incident is not a new requirement for state agencies. State agencies should continue to report incidents through the Enterprise Service Desk.

The goal is to collect relevant information that can help us understand how security controls are bypassed and assist other organizations in defending IT resources and data. 

Required entities should report cybersecurity incidents that impact services, systems, or people. This includes successful cyber events that compromise agency accounts, systems, data, or events that bypass security controls and target government systems. Incidents where Criminal Justice Information (CJI) and systems may have been impacted are always reportable, regardless of the guidance listed below.

Compromised Account/Password 

• What it is: When a bad actor gains access to someone’s account by stealing credentials (passwords, usernames, etc.). 
• Reportable incidents:  
  • When an employee’s credentials are used to access accounts or data, regardless of whether a data breach occurs.  
  • Exposed employee credentials that were secured before a bad actor misuses them, if techniques were involved to gain access (optional if other defenses prevented access/misuse). 
• Non-Reportable incidents:
  • User realizes that they fell for a phishing email and provided credentials to a bad actor and immediately changes their password.
  • When a user shares their credentials with a co-worker, changes their password and they are educated on the risk of sharing credentials.

Defacement 

• What it is: An attack where a bad actor alters the appearance of a website, usually to spread a message or cause embarrassment. 
• Reportable incidents: 
  • Malicious changes or replacement of website or digital content, often involving social or political messaging, or meant to draw attention for other reasons. 
  • Redirection of website visitors to a different site, often containing malware or malicious content. 
• Non-Reportable incidents:
  • Unwanted web form submissions (spam-like use of web forms).
  • Unwanted comments submitted on web forums or through website content (submit as Malware or Social Engineering if applicable).

Denial of Service (DoS) 

• What it is: A flood of traffic that overwhelms a website or online service, making it unavailable to users. 
• Reportable incidents: 
  • Impactful DoS and Distributed Denial of Service (DDoS) events that disrupt services and evade defensive tools. 
  • Noteworthy DoS and DDoS events (even if mitigated or non-impactful) when the indicators, methods, or volume of attacks could help defend other entities. 
• Non-Reportable incidents:
  • Server or network misconfigurations that lead to service outages.
  • Outages caused by legitimate traffic that exceeds anticipated thresholds without malicious causes.

Malware 

• What it is: Malicious software that can damage or disrupt computers or networks, or steal information. 
• Reportable incidents: 
  • Malware that bypasses security controls and executes without detection by existing defenses. 
• Non-Reportable incidents:
  • Malware detected and blocked by existing cyber defense tools (including spam/malware filters, desktop anti-malware/EDR tools, firewalls, etc.).

Network Attack 

• What it is: Unauthorized access to a computer network, often with the intent to steal data or cause harm.  
• Reportable incidents: 
  • Malicious activity aimed at disrupting, damaging, or gaining unauthorized access to computer networks. Common network attacks include Denial of Service (DoS), Distributed Denial of Service (DDoS), Man-in-the-Middle (MITM), phishing, Structured Query Language (SQL) injections, malware, and insider threats.
• Non-Reportable incidents:
  • Network scans and routine fingerprinting that do not create impact (common internet background noise).

Operational Technology/Industrial Control System/Supervisory Control and Data Acquisition (OT/ICS/SCADA) 

• What it is: Attacks targeting systems that control industrial processes, such as factories or utilities. 
• Reportable incidents: 
  • Successful attacks on OT networks, controllers, or human-machine-interfaces that result in physical damage or disruption. 
• Non-Reportable incidents:
  • Network scans and routine fingerprinting that do not create impact.

Potential Data Exposure

• What it is: Unauthorized access of data maintained by a public entity that compromises the security and classification of data. 
• Reportable incidents:  
  • Phishing attacks that lead to data access and exfill. 
  • Any instance where personal data are obtained by deception or accessed, altered, deleted, and/or disclosed by the attacker.
  • Exposed data on public sites, servers, or third-party applications where protected data may have been exposed publicly.  
• Non-Reportable incidents:
  • Sending sensitive information to the wrong recipient (i.e. via email). 
  • Inadvertent disclosure of sensitive information not caused by a malicious cybersecurity event or public exposure.

Ransomware 

• What it is: Malware that encrypts (locks) users out of their data or systems until a ransom is paid to the attacker. 
• Reportable incidents:  
  • Any instance of ransomware software that encrypts or locks data maliciously by a bad actor, even if encryption did not occur. 
• Non-Reportable incidents:
  • Scareware pop-ups that act like ransom notices, but do not actually infect or encrypt system data.
  • Email-based spam that does not include malware or methods that hold systems hostage and encrypt data.

Social Engineering 

• What it is: When a bad actor tricks, manipulates, influences, or deceives people into sharing information they shouldn’t share, downloading software that they shouldn’t download, or performing actions that compromise security to gain control over a computer system or to steal information. 
• Phishing is a type of social engineering where a bad actor sends fraudulent messages, often via email, to trick individuals into selecting links, revealing personal information, or installing malware. 
• Reportable incidents: 
  • Novel phishing events that successfully bypass security controls and result in account or system compromise.
  • Other emails, texts, or content that successfully trick employees into revealing information or taking other action not authorized by their employer 
• Non-Reportable incidents:
  • Spam and phishing messages that are detected and blocked by existing spam filters.
  • Common phishing messages that users detect and delete successfully and do not use novel methods that are likely to trick others.

Unauthorized Access 

• What it is: Gaining access to a system, network, or data without permission.  
• Reportable incidents: 
  • When cybersecurity tools are defeated, or cybersecurity controls are ineffective, and a bad actor gains unauthorized access to a system, network, or data. 
• Non-Reportable incidents:
  • Unsuccessful events where existing tools and controls prevent access.
  • Inappropriate use by authorized staff should be investigated and acted upon appropriately, but is not reportable through this process.

Web Application Attack 

• What it is: An attack targeting a website or online service to steal data, disrupt services, or gain unauthorized access. 
• Reportable incidents: 
  • Impactful attacks that exploit vulnerabilities in web applications, leading to unauthorized data access or application modifications. 
• Non-Reportable incidents:
  • Application scans and attacks that are blocked by existing defenses and are not impactful.

The report must be made: 

• Within 24 hours if Criminal Justice Information and systems are impacted. 
• Within 72 hours of the government entity or the public agency or the contractor discovering the incident or reasonably identifies or believes that a cybersecurity incident has occurred.

MNIT and BCA understand that some incidents may take longer than the 24 hours CJIS or the 72 hours to fully investigate. However, we encourage entities to submit an initial report within this timeframe to document the event and capture key indicators for sharing through state threat channels. The required cybersecurity incident reporting is in addition to other reporting requirements, like those for the Office of the Legislative Auditor (OLA) and data breach reports required by Minnesota law. Entities are expected to submit reports more than once if needed.

Before sharing threat reports with local entities, we will anonymize and combine the information gathered through cybersecurity incident reporting to ensure the names and details of impacted organizations remain confidential.

The form below is the primary method to report a cybersecurity incident.  

If you cannot access the form or need to report via another method, you can call or send an email to report a cybersecurity incident. State agencies can then submit a ticket in the Minnesota Service Hub.  

Call: Required entities can place a phone call to one of the following services to report an incident. 

• MNIT Enterprise Service Desk: 651-297-1111 or 1-888-717-6638 
• Minnesota Fusion Center (MNFC): 651-793-3730 or 1-800- 422-0798  
• Bureau of Criminal Apprehension – Information Security Office (BCA/ISO): 651-793-2500 

Email: Email can be sent to one of the following services to report an incident.  

• For all incidents, send a copy to mn.fc@state.mn.us and cn.mnit@state.mn.us.
  
• Emergent election issues also include: MNOSS.cybersecurity@state.mn.us.
• Emergent Criminal Justice Information and system issues also include: bca.servicedesk@state.mn.us and bca.iso@state.mn.us.