‘No government entity, large or small, previously targeted or not, is immune’: Ransomware attacks on government agencies have surged 91% in a year

Governments now face ransomware attacks more than once a day, according to research from Comparitech.

Research from the firm recorded a 47% increase from the second quarter of 2026 to the third quarter, with the number of attacks tracked rising from 90 to 132.

That works out to 1.4 attacks every day, with attacks also surging by 91% compared to the same period last year.

"It goes without saying that governments remain a focus for hackers because of the sheer amount of disruption these attacks can cause, both through system encryption and data theft," said Rebecca Moody, Head of Data Research at Comparitech.

"But what our Q3 report demonstrates is that, as ransomware attacks continue to increase in volume, it has never been more important for government entities to do what they can to mitigate these risks and have a worst-case-scenario plan in place."

The US was targeted with the most attacks, 41 of the total 132 recorded, an increase of 78%, followed by Germany – but ransomware hit governmental organizations across the world.

"No government entity, large or small, previously targeted or not, is immune," added Moody.

More ransomware disruption ahead

Some of the organizations affected faced severe downtime following attacks, according to Comparitech. The firm noted that the Angolan state telecommunications agency Unitel suffered three weeks of disruption after an attack.

The American city of Coweta took two weeks to restore services, while in Ayuntamiento de Collado Villalba, Spain, services were brought online after a week of 16-hour workdays.

Comparitech noted that the US county of Merrimack was able to avoid paying a ransom and dodged serious disruption "thanks to its regular backups."

"As part of their worst-case-scenario plan, government entities not only need to have a clear strategy in place for how they will deal with an attack (e.g. making sure there are regular backups in place to get systems back online as soon as possible), but they also need to assume that a data breach has occurred," Moody added.

High costs

The costs can also be high, the study warned. Beaver County Behaviour Health paid $175,000 to unknown hackers, with Comparitech saying the average ransom demand was more than half a million dollars.

Some authorities faced higher ransom demands. Anne Arundel County, for example, was hit with a demand for $2m, though such ransoms weren't paid. In that latter incident, attackers from Rhysida stole 2.6TB of data, some of it sensitive including medical information, social security numbers and payroll data.

As Comparitech noted in a blog post, it's the second ransomware incident to hit that US county in the last year and a half: "Official letters to those affected in the first attack from February 2025 have only just been sent in the last month."

Moody added that warnings to victims need to arrive in a timely manner to help avoid fraud.

"Hackers will have stolen data in the majority of cases, so issuing warnings to anyone involved promptly is essential to safeguarding this data," she said.

"Better to warn people straight away and retract this warning later on if data hasn't been stolen, than to avoid warning people until months after the attack when there's little they can do if their data has been floating around on the dark web for all that time."

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.