A ransomware attack on a city hall doesn’t just lock up files—it can impact citizen services, some that are legally required. It can shut down 911 dispatch, freeze water billing, stall court proceedings, or leave residents unable to pay a permit fee or register a car. For state and local government, ransomware isn’t an abstract IT risk. It’s a public safety and continuity-of-government problem, and the data shows that attackers know it.
Why Local Governments Keep Getting Hit
It’s tempting to assume ransomware gangs go after the biggest, richest targets. In practice, they go after the softest ones. Municipalities check almost every box on an attacker’s wish list.
Local governments run essential, citizen-facing services that cannot be down for long. While a private company can sometimes absorb a few days of disruption, a county government can’t tell residents that court dates, water service, or emergency dispatch are on hold indefinitely. That urgency creates leverage, and leverage is exactly what a ransomware operator is trying to buy when they encrypt a network.
At the same time, most municipalities operate with the budget and staffing of a small business trying to defend the infrastructure of a mid-size enterprise. Many towns and counties have no dedicated security staff at all; IT generalists are expected to handle firewalls, help desk tickets, and incident response with the same three people. Security investment is consistently outpaced by the cost of a single successful attack, which is part of why researchers have described payment-ban laws as “all stick and no carrot,” they remove one option without funding the alternative.
Layer on legacy technology and the picture gets worse. Permitting systems, tax platforms, and ERP software in local government are frequently a decade or more old, running on infrastructure that can’t easily support modern authentication or endpoint protection. Fulton County, Georgia discovered this the hard way in its 2024 LockBit attack, when officials found themselves running enterprise software that was reportedly seven versions behind, a gap so severe it triggered a $10 million-plus emergency overhaul.
Then there’s the data itself. City and county systems hold Social Security numbers, health records, police and crime-victim files, and court documents, all of which are valuable for double extortion. And for years, local governments developed a reputation as reliable payers, particularly after early ransom payments by a handful of Florida cities. Once attackers believe a sector will pay, that sector stays in the crosshairs.
The numbers back this up.Sophos’ 2024 survey of state and local government IT leaders found that although the share of organizations hit by ransomware actually declined year over year, the attacks that did land were far more damaging: 98% resulted in successful data encryption, the highest rate of any sector surveyed, and the mean cost to recover from an attack more than doubled to $2.83 million. Comparitech’s tracking shows a similar trend in raw attack counts, climbing from 41 US government ransomware incidents in 2022 to 88 in 2024, with total downtime costs since 2018 estimated above $1 billion. The FBI’s Internet Crime Complaint Center called ransomware the most pervasive threat to critical infrastructure in its 2024 annual report.
Recent incidents put a face on the statistics. Fulton County’s courts, phone systems, and tax and water billing all went down in the January 2024 LockBit attack. The City of Dallas spent an estimated $8.5 million recovering from a 2023 Royal ransomware intrusion that began with a single compromised service account and went undetected for roughly a month before encryption hit. Columbus, Ohio was hit by Rhysida in mid-2024, and when the group leaked stolen data after a failed extortion attempt, the city faced public criticism not just for the breach itself but for how it communicated about the damage. These aren’t edge cases. They are becoming the normal cost of doing business without adequate cyber defenses in the public sector.
The Vulnerabilities Behind the Headlines
Local government ransomware incidents often trace back to a short list of recurring weaknesses, often the same gaps a resilience plan needs to address.
Identity is the number one problem. Compromised credentials, not exploited software vulnerabilities, are now the leading cause of state and local government ransomware incidents, and the common thread is inconsistent or absent multi-factor authentication. Even organizations that have “deployed MFA” often leave gaps in service accounts, legacy applications, and VPN access, and those gaps are exactly where attackers get in.
Unpatched and end-of-life systems remain a close second, especially internet-facing VPNs and firewalls, which are attractive precisely because a single unpatched appliance can offer a direct path into the network.
Flat, unsegmented networks turn a single compromised workstation into a domain-wide event. Once inside, attackers routinely move laterally with little resistance, which is one reason average incidents in this sector affect more than half of an organization’s computers.
Backups are under direct attack. Nearly all state and local government victims in recent surveys reported that attackers specifically targeted their backup infrastructure. A backup strategy that isn’t offline, isolated, and tested is not really a recovery plan; it’s a false sense of security.
Limited visibility and monitoring compound everything else. Without endpoint detection tools and centralized logging, dwell time stretches from hours into weeks, giving attackers time to map the network, steal data, and disable recovery options before ever triggering an alarm.
Building a Resilience Plan That Actually Holds Up
The good news is that none of this requires reinventing the wheel. CISA’s Cross-Sector Cybersecurity Performance Goals and the joint #StopRansomware guide from CISA, the FBI, and MS-ISAC lay out a framework that is well suited to resource-constrained governments, and much of it starts with resources that are free.
Start with an honest asset inventory. You can’t protect systems you don’t know you have. Prioritize the fixes that address root causes rather than symptoms: phishing-resistant MFA across every remote access, privileged, and email account, including the service and legacy accounts that tend to get overlooked; endpoint detection and response deployed broadly rather than on a handful of “important” machines; and a backup strategy built on the 3-2-1 principle, with immutable and offline copies that are tested through actual restores, not just backup job success reports.
Network segmentation deserves real attention too, particularly isolating operational technology like water systems from the general IT environment and limiting how far an attacker can travel from any single foothold.
A local government ransomware response plan turns these defenses into a coordinated strategy for the day an attack happens. A ransomware-specific incident response playbook, distinct from a generic disaster recovery plan, should spell out who has authority to make a payment decision, in what order notifications go out, and how systems get isolated by category. That plan should be tested through tabletop exercises, ideally with elected officials in the room, since a decision about whether to pay a ransom is ultimately a policy decision, not just a technical one.
Local governments should also lean on the support built specifically for them. Membership in MS-ISAC is free for state, local, tribal, and territorial governments and includes threat intelligence, incident response support, and free protective DNS filtering that can be deployed in about fifteen minutes. The State and Local Cybersecurity Grant Program has directed close to a billion dollars toward exactly these kinds of improvements since 2022, and it exists because federal policymakers recognize the resource gap described above.
When an Attack Happens: Do’s and Don’ts
Even a well-prepared organization can get hit, and how the first hours are handled shapes the entire recovery.
Do isolate affected systems immediately by disconnecting them from the network, rather than shutting them down. Powering off machines can destroy the very evidence and encryption artifacts that forensic investigators need. Do notify the right parties quickly: the FBI, CISA, the cyber insurance carrier, and legal counsel, in that rough order of urgency, since delayed notice to an insurer can jeopardize coverage entirely. Do bring in a professional incident response firm rather than attempting to negotiate or rebuild systems independently, and check whether a free decryptor already exists for the specific ransomware strain before considering any other option.
Don’t rush to pay. Payment does not guarantee data is deleted or even usable for recovery, and organizations that pay once are frequently targeted again. It’s also worth noting that a growing number of states, including North Carolina, Florida, Tennessee, and Ohio, now restrict or outright ban ransom payments by public entities, and North Carolina law goes further by prohibiting government employees from even communicating with attackers. Don’t restore from backups before confirming they’re clean, and don’t get ahead of the facts publicly. Columbus, Ohio faced significant backlash after early public statements about the scope of a breach turned out to understate the damage—a reminder that transparency, even when the news is bad, tends to hold up better than reassurance that doesn’t.
The Bottom Line
Ransomware attacks on municipalities aren’t slowing down because attackers are being merciful. They’re a predictable consequence of high-value, high-pressure targets defended with limited resources. The path forward isn’t complicated, even if it takes sustained effort: strong identity controls, tested backups, real segmentation, and a rehearsed response plan. Local governments that treat resilience as an ongoing program, not a one-time project, are the ones that turn a potential city-wide crisis into a manageable incident.
About the author
Justin is the founder and CEO of nuHarbor, where he continues to advance modern integrated cybersecurity services. He has over 20 years of cybersecurity experience, much of it earned while leading security efforts for multinational corporations, most recently serving as global CISO at Keurig Green Mountain Coffee. Justin serves multiple local organizations in the public interest, including his board membership at Champlain College.
