Desk live·
ForensicPost
Ransomware/Analysis/File 26-0330

Government Ransomware Rose 65%, and the Target Profile Explains Why

Ransomware incidents against government bodies rose 65% year on year in the first half. Municipalities combine visible service disruption, thin capacity and a public that notices immediately.

Constructed geometry · not a chart of case data
TargetState and local government
ActorMultiple
D. Kennedy11 min readConfidence: medium2 sources reviewed

Ransomware incidents affecting government bodies rose approximately 65% year on year in the first half of the comparison period, according to sector analysis.

Read against the incidents filed at 26-0310 and 26-0126, the target profile is coherent rather than random.

Three Properties That Make A City Attractive

Disruption is immediately visible. A city that cannot issue permits generates local news within hours, which produces political pressure that a private company facing the same outage would not.

Capacity is thin. A mid-sized municipality runs a small IT function covering everything from desktops to the water plant, and rarely employs anyone whose full-time job is security.

And the service cannot be sourced elsewhere. Residents have no alternative supplier, so demand accumulates rather than dispersing.

The Pressure Is Applied To Elected Officials

That combination puts the payment decision in an unusual place. In a company it sits with executives weighing commercial harm. In a city it sits with officials facing residents who cannot get a licence, in public, with a council meeting scheduled.

Attackers understand this. The calculation is not that the city has money; it is that the city has visible pain and a decision-maker who is accountable to people experiencing it.

What The Successful Cases Had

Both municipal files this desk has published this quarter maintained essential services through separation and manual continuity. Neither capability appears in a security product catalogue, and both are the kind of spending that is hardest to defend before an incident.

How we reported this

This is an analysis file built on published sector research, listed below, read against incidents previously filed by this desk. Growth figures depend on the researchers’ counting rules. Corrections: corrections@forensicpost.com.

Sources
  1. U.S. state and local government under ransomware: 2025–2026 trend analysisSOCRadar
  2. Ransomware and municipal governments: risks, impacts and practical responsesWarren Averett
D. Kennedy
Identity and access reporter. Former DFIR consultant. Signal on request.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary