Ransomware Attacks on Government Agencies Rise 91 Percent
The surge in incidents forces agencies to rely on backups as average ransom demands now exceed $500,000 for public entities.
Updated on Oct. 30, 2026 in Cybersecurity
Live Poll
Do you trust your local government agencies to adequately protect your personal data from cyberattacks?
Ransomware attacks against government agencies rose 91% over the past year, reaching 132 incidents in the third quarter of 2026. The increase includes significant disruptions at institutions ranging from municipal offices to telecommunications providers.
Why it matters
The surge in attacks underscores the growing vulnerability of public infrastructure as hackers prioritize targets where the pressure for immediate service restoration incentivizes ransom payments.
Government entities faced an average of 1.4 ransomware attacks per day during the third quarter of 2026. Data exfiltration remains a primary threat, exemplified by the 2.6TB of information stolen from Anne Arundel County by the group Rhysida.
The players
Rhysida
A ransomware operator known for encrypting systems and exfiltrating large volumes of sensitive government and corporate data.
Unitel
An Angolan state telecommunications agency that experienced a three-week service disruption following a ransomware attack.
Anne Arundel County
A U.S. government organization that faced a $2 million ransom demand after attackers stole 2.6TB of data.
The details
Attackers primarily use system encryption to lock files, creating service disruptions that often last for weeks while agencies attempt to restore systems from backups. In instances where decryption or recovery fails, agencies face extreme financial pressure; for example, Anne Arundel County received a $2 million ransom demand, while Beaver County Behaviour Health opted to pay a $175,000 ransom.
Timeline
February 2025: Initial ransomware attack occurred at Anne Arundel County.
Q2 2026: Baseline period for recorded ransomware attacks.
Q3 2026: Reported period for 132 ransomware attacks.
September 2026: Notification letters sent regarding the February 2025 attack.
The Tech Race
The current escalation mirrors the tactical shift observed during the 2021 Colonial Pipeline ransomware attack by targeting entities with low downtime tolerance. Government agencies are struggling to outpace this trend, as the average ransom demand now routinely exceeds $500,000.
Public sector entities are increasingly prioritizing data backups as the primary mechanism for system restoration to avoid paying average ransom demands of $500,000. Residents in affected regions like Coweta can expect potential multi-week delays in government services during incident recovery.
The takeaway
The sustained increase in frequency and ransom demands suggests that government agencies will remain high-value targets for data extortion. Organizations are now watching to see if federal support initiatives can lower the daily incidence rate of 1.4 attacks currently observed across the sector.
Further reading
For more information on threat mitigation, see the Cybersecurity section.
Source note: This article includes information reported by ITProUK.
Live Poll
Do you trust your local government agencies to adequately protect your personal data from cyberattacks?
