‘No government entity, large or small, previously targeted or not, is immune’: Ransomware attacks on…

The Escalating Frequency of Cyber Aggression

The Q3 2026 report paints a stark picture of the current threat environment. Between the second and third quarters of 2026, the number of confirmed ransomware attacks against government organizations jumped from 90 to 132, representing a 47% quarter-over-quarter increase. When viewed on an annual basis, the surge is even more pronounced: a 91% increase compared to the same period in 2025. This frequency translates to an average of 1.4 successful attacks every single day, suggesting that the "new normal" for government IT departments involves constant vigilance against imminent system compromise.

Rebecca Moody, Head of Data Research at Comparitech, notes that the appeal of government targets to malicious actors lies in the dual-threat nature of these attacks. By encrypting critical systems and simultaneously exfiltrating sensitive data, hackers create an environment where the victim is pressured to pay to restore essential services while also fearing the reputational and legal fallout of a massive data breach. "It goes without saying that governments remain a focus for hackers because of the sheer amount of disruption these attacks can cause," Moody explained. "But what our Q3 report demonstrates is that, as ransomware attacks continue to increase in volume, it has never been more important for government entities to do what they can to mitigate these risks and have a worst-case-scenario plan in place."

Global Distribution and Geographic Impact

While the phenomenon is global, the United States remains the most frequent target. Out of the 132 documented attacks in Q3 2026, 41 occurred within the U.S., reflecting a staggering 78% increase in domestic attacks for that region alone. Germany followed as the second most-targeted nation. However, the geographic spread of these incidents suggests that no region is exempt from the threat.

The diversity of targets—from the Angolan state telecommunications agency Unitel to municipalities in Spain and various counties across the United States—demonstrates that threat actors are indifferent to the size or political stature of the entity. Smaller, under-resourced local governments often serve as "low-hanging fruit" for attackers who rely on automated scanning to identify unpatched vulnerabilities or weak authentication protocols. "No government entity, large or small, previously targeted or not, is immune," Moody added, emphasizing that the barrier to entry for these criminals is low, while the potential for significant disruption is exceptionally high.

Chronology of Disruption: Real-World Case Studies

The operational impact of these breaches is measured in weeks, not days. The case of Angola’s Unitel serves as a cautionary tale of the long-term operational paralysis that can follow a successful breach. The agency experienced three weeks of severe disruption, illustrating how deep-seated the damage can be when backup recovery systems are not robust.

In the United States, the city of Coweta required a two-week period to fully restore its services, during which time citizens were likely unable to access critical municipal portals. Similarly, in the Spanish municipality of Ayuntamiento de Collado Villalba, IT staff were forced into a grueling schedule of 16-hour workdays for a full week just to bring essential services back online. These examples underscore that the "cost" of ransomware is not limited to the ransom demand itself; it includes the massive, unbudgeted expenditure of labor, loss of public trust, and the interruption of vital civil services.

Conversely, the success of the U.S. county of Merrimack highlights the efficacy of fundamental cybersecurity hygiene. By maintaining consistent, off-site, and air-gapped backups, Merrimack was able to restore its systems without succumbing to the financial demands of the extortionists. This serves as a vital proof-of-concept for the industry: the most effective defense remains the ability to recover independently of the attacker’s cooperation.

The Financial Burden and Data Extortion

The financial implications of these incidents are staggering. While some entities, like Beaver County Behaviour Health, have reportedly paid ransoms as high as $175,000, the average demand has climbed to over $500,000. These figures, however, do not account for the total economic impact, which includes forensic investigation costs, legal fees, public relations management, and long-term system hardening.

In some instances, the demands are astronomical. Anne Arundel County faced a $2 million ransom demand after the Rhysida hacking group managed to exfiltrate 2.6 terabytes of data. This breach was particularly damaging because it contained sensitive medical information, Social Security numbers, and payroll data. Notably, this was the second major incident to strike the county in just 18 months, highlighting the persistent nature of modern threat actors. The delay in notifying victims—with some letters for a February 2025 breach only reaching recipients late in 2026—serves as a critical failure point. Moody emphasizes that the speed of communication is as important as the security of the infrastructure. "Better to warn people straight away and retract this warning later on if data hasn’t been stolen, than to avoid warning people until months after the attack," she stated.

Strategic Analysis: The Path Forward

The data suggests that we are entering an era of "persistent state-level cyber instability," where the boundary between criminal enterprise and geopolitical friction is increasingly blurred. For governments, the implications are clear: the reactive posture of the past is no longer sustainable.

1. Assumption of Breach: As Moody suggests, government entities must move toward a "Zero Trust" framework, operating under the assumption that a breach is not just possible, but potentially already in progress. This requires continuous monitoring of network traffic and identity management.
2. Prioritization of Backup Integrity: The Merrimack example proves that backups are the ultimate insurance policy. However, these backups must be immutable—incapable of being encrypted or deleted by the ransomware itself.
3. Transparent Disclosure Policies: As evidenced by the delays in Anne Arundel County, the failure to communicate with the public erodes trust. Governments need clear, pre-approved incident response protocols that include immediate public notification, even before the full scope of a breach is understood.
4. Inter-Agency Collaboration: Because these syndicates operate internationally, individual municipal or regional governments cannot fight this battle alone. Increased intelligence sharing between national cybersecurity agencies and local government bodies is essential to identifying patterns and signature behaviors of prominent groups like Rhysida.

As the Q3 2026 statistics confirm, the frequency and intensity of these attacks are only set to rise. For the public sector, the challenge of the coming decade will be to balance the digital transformation of civil services with the aggressive, hardened security protocols necessary to protect the sanctity of citizen data and the continuity of the state. Without a concerted, well-funded, and rapid pivot toward these defensive strategies, the cycle of disruption, extortion, and recovery will continue to impede the progress of modern governance.