‘No government entity, large or small, previously targeted or not, is immune’: Ransomware attacks on government agencies have surged 91% in a year - IT Pro
Ransomware attacks on government agencies have surged 91% in the past year, with governments now facing more than one attack daily, according to research from Comparitech.
Research from Comparitech shows a 47% increase in ransomware attacks on government agencies from the second quarter to the third quarter of 2026, with attacks rising from 90 to 132. This translates to approximately 1.4 attacks every day, marking a 91% surge compared to the same period last year.
No government entity, large or small, previously targeted or not, is immune.
Global Impact
The United States was the most targeted nation, experiencing 41 of the 132 recorded attacks—a 78% increase. Germany followed, but ransomware attacks affected governmental organizations worldwide. The Angolan state telecommunications agency Unitel suffered three weeks of disruption following an attack, while the American city of Coweta took two weeks to restore services. In Spain's Ayuntamiento de Collado Villalba, services were restored after a week of 16-hour workdays.
Financial Costs
The financial impact of these attacks is substantial. Beaver County Behaviour Health paid $175,000 to hackers, with the average ransom demand exceeding half a million dollars. Anne Arundel County faced a $2 million ransom demand, though it wasn't paid. In that incident, attackers from Rhysida stole 2.6TB of sensitive data, including medical information and social security numbers.
Comparitech noted that Anne Arundel County experienced its second ransomware incident in the last year and a half, with official letters to victims of the first attack from February 2025 only being sent in the past month.
Prevention Measures
The US county of Merrimack avoided paying a ransom and serious disruption by maintaining regular backups. Rebecca Moody emphasized the need for government entities to have clear strategies for dealing with attacks, including regular backups and assuming data breaches have occurred.
Moody stressed the importance of timely warnings to victims: 'Better to warn people straight away and retract this warning later on if data hasn't been stolen, than to avoid warning people until months after the attack when there's little they can do if their data has been floating around on the dark web for all that time.'
Related
