Government Departments Hit by Ransomware Daily as Attacks Surge 13%

The alarming frequency of ransomware attacks targeting government entities has reached a critical point, with an average of one government service being impacted by encryption every single day. This stark reality is revealed in a comprehensive analysis by researchers at Comparitech, who meticulously examined ransomware incidents that afflicted government departments and agencies during the first half of 2026. The findings paint a concerning picture of escalating cyber threats against public institutions, highlighting the significant disruption and potential data breaches that have become commonplace.

The research, officially published on July 16, 2026, documented a total of 187 government organizations falling victim to ransomware attacks between January and June of that year. This figure represents a substantial 13% increase compared to the 165 ransomware attacks recorded in the latter half of 2025. The sheer volume of these incidents, occurring over 182 days, underscores the daily onslaught faced by government bodies. Of the 187 recorded incidents, a concerning 89 were publicly confirmed by the affected organizations, suggesting that the true number of attacks may be even higher, with many instances potentially remaining undisclosed due to reputational concerns or ongoing investigations.

Rebecca Moody, head of data research at Comparitech, emphasized the strategic advantage these institutions offer to cybercriminals. "From weeks-long disruptions due to system encryption to extensive data breaches, governments are the ideal target for hackers," Moody stated. This heightened vulnerability stems from the dual nature of government operations: the critical public services they provide, which can be easily paralyzed by encrypted systems, and the vast repositories of sensitive data pertaining to citizens that they hold. The potential for widespread disruption and the leverage gained from possessing such data significantly increase the likelihood of victims succumbing to ransom demands, rather than enduring prolonged and costly service restoration efforts that directly impact the public.

US Dominates as Prime Ransomware Target

Geographically, the United States emerged as the most frequent target for ransomware attacks against government agencies during the analyzed six-month period, accounting for a significant 31% of all reported incidents. This disproportionate targeting of the US is likely attributable to its sheer size and the extensive digital infrastructure of its government at federal, state, and local levels. In stark contrast, every other nation with reported ransomware incidents represented only a single-digit percentage of the total. Germany, with 7% of attacks, followed by Spain and Italy, each with 4%, were the next most affected countries. This disparity suggests that while ransomware is a global threat, its impact on US government entities is particularly pronounced.

Ransom Demands and Notable Cases

The average ransom demand levied against government agencies during the first half of 2026 stood at $100,000. This figure suggests a calculated approach by cybercriminals, who likely recognize that excessively high demands, especially from taxpayer-funded organizations, may be met with refusal. The intention is often to secure a payment rather than risk the complete loss of potential earnings.

However, the period was not without its significant outliers. One of the most substantial ransom demands on record occurred in January 2026, when the Land and Agricultural Development Bank of South Africa was targeted. The attackers demanded a staggering $3.1 million for the decryption of their systems. Despite the immense pressure, the organization resolutely refused to pay the ransom. Consequently, their systems remained encrypted for an extended period, with full restoration only achieved in April 2026, a testament to the protracted disruption that can ensue when ransoms are not paid.

While the perpetrators of the South African bank attack remain unknown, a significant portion of other ransomware incidents could be attributed to well-established and prolific cybercriminal groups. Between January and June 2026, the most frequently identified attackers were "The Gentlemen," responsible for 10% of incidents, followed closely by "Qilin" at 9%, and "LockBit," a notorious ransomware-as-a-service operation, at 7%. These groups consistently exploit known and publicized cybersecurity vulnerabilities, underscoring the ongoing challenge of patching and securing systems against evolving threats.

Chronology of a Growing Threat

The escalating trend of ransomware attacks against government entities has been a growing concern over several years. While the Comparitech report focuses on the first half of 2026, its findings are indicative of a longer-term trajectory.

• Late 2023 – Early 2024: Initial reports begin to highlight an increasing number of ransomware attacks targeting local governments and critical infrastructure, often resulting in service disruptions and financial losses. Cybersecurity firms issue warnings about the growing sophistication of ransomware gangs and their focus on public sector targets.
• Mid-2024: The trend continues, with several high-profile attacks making headlines. Government agencies begin to acknowledge the severity of the threat and explore enhanced cybersecurity measures, including increased investment in detection and response capabilities.
• Late 2024 – Early 2025: Ransomware groups begin to adapt their tactics, increasingly employing double extortion techniques, where data is not only encrypted but also exfiltrated and threatened to be leaked if the ransom is not paid. This adds another layer of pressure on victims.
• January 2026: The Land and Agricultural Development Bank of South Africa experiences a significant cyber-attack, leading to a $3.1 million ransom demand. The organization’s decision not to pay sets a precedent for resilience, though the extended downtime highlights the cost of such a stance.
• February – June 2026: Comparitech’s analysis period begins. The data reveals a consistent and elevated rate of attacks against government bodies worldwide, averaging one incident per day. Major ransomware groups like The Gentlemen, Qilin, and LockBit are identified as key players.
• July 16, 2026: Comparitech publishes its findings, providing concrete data that quantifies the daily impact of ransomware on government services and highlighting the 13% surge in attacks compared to the previous six-month period.

This chronological progression illustrates a consistent and intensifying threat landscape, moving from localized incidents to widespread, daily disruptions across the globe.

Broader Impact and Implications for Public Services

The implications of these escalating ransomware attacks extend far beyond mere financial losses. The encryption of government systems can cripple essential public services, impacting everything from emergency response and healthcare to administrative functions and the delivery of social benefits. When a local government’s tax collection system is encrypted, it can lead to delays in funding for schools and public works. When a transportation authority’s systems are compromised, it can result in widespread travel chaos.

The constant threat of ransomware also forces government agencies to divert significant financial and human resources away from their core mandates and towards cybersecurity. This includes the cost of incident response, recovery, potential ransom payments (though discouraged), and the implementation of more robust security measures. Furthermore, the potential for sensitive citizen data to be compromised raises serious privacy concerns and can erode public trust in government institutions.

The data breach aspect of ransomware attacks is particularly concerning. Sensitive personal information, including social security numbers, financial details, and medical records, can be exfiltrated. This data can then be sold on the dark web, leading to identity theft, financial fraud, and other malicious activities that can have long-lasting repercussions for affected individuals. The reputational damage to a government agency that suffers a significant data breach can be immense, making it harder to conduct its operations effectively and maintain public confidence.

Expert Recommendations for Mitigation

In response to this pervasive threat, cybersecurity experts consistently advocate for a multi-layered and proactive defense strategy. Rebecca Moody of Comparitech reiterates the fundamental importance of such an approach. "Keeping systems up to date, patching vulnerabilities as soon as they’re flagged, carrying out regular backups, and making sure employees are regularly trained and are on high alert at all times are crucial to mitigating the risks of attacks," she advised.

These recommendations form the bedrock of effective cybersecurity for any organization, but they are particularly vital for government entities due to their critical role in society.

• Vulnerability Management and Patching: Regularly scanning for and promptly patching software vulnerabilities is paramount. Cybercriminals frequently exploit known weaknesses, and delaying patches provides them with easy entry points. This requires robust patch management policies and efficient deployment mechanisms.
• Robust Backup and Recovery Strategies: Maintaining frequent, tested, and isolated backups is a critical safety net. In the event of an encryption attack, having clean, recent backups can allow an organization to restore its systems without paying a ransom. These backups should be stored offline or in a separate, secure environment to prevent them from being compromised alongside the primary systems.
• Employee Training and Awareness: Human error remains a significant factor in many cyberattacks, particularly phishing attempts that can lead to malware infections. Comprehensive and ongoing cybersecurity awareness training for all government employees is essential. This training should cover identifying phishing emails, understanding social engineering tactics, and adhering to secure computing practices.
• Network Segmentation and Access Control: Implementing network segmentation can limit the lateral movement of attackers within a network. If one segment is compromised, the damage can be contained. Strict access control, adhering to the principle of least privilege, ensures that users only have access to the information and systems necessary for their job functions.
• Incident Response Planning: Having a well-defined and regularly practiced incident response plan is crucial. This plan should outline the steps to be taken in the event of a ransomware attack, including identification, containment, eradication, recovery, and post-incident analysis. This ensures a coordinated and efficient response, minimizing downtime and damage.
• Threat Intelligence: Staying informed about the latest threats, attack vectors, and the tactics, techniques, and procedures (TTPs) of active ransomware groups is vital. This intelligence can inform defensive strategies and help organizations proactively address emerging risks.

The ongoing surge in ransomware attacks against government departments serves as a stark reminder of the persistent and evolving nature of cyber threats. While the figures from Comparitech’s analysis are concerning, they also provide valuable data that can inform stronger defenses and more resilient public services in the face of an increasingly hostile digital landscape. The daily toll on government operations underscores the urgent need for sustained investment in cybersecurity and a collective commitment to safeguarding the vital services that citizens rely upon.