Cyberattacks on Local Governments Are Increasing

Cyberattacks on local governments are on the rise — and for good reason.

“They’re target-rich and cyber-poor,” explained Michael Klein, senior director for preparedness and response at the Institute for Security and Technology, a non-profit security think tank in Oakland, Calif.

“Local governments hold all kinds of data that criminals want — social security numbers, health data, kids’ data, payment systems — and often those are only defended by small government levels of security,” he told TechNewsWorld.

Local government agencies typically have more people wearing multiple hats for a variety of reasons, including budget and staffing constraints, noted Ashley Knowles, a senior cybersecurity consultant at Black Hills Information Security, a penetration testing, red teaming, and threat hunting company in Spearfish, S.D.

“So it can be harder to patch systems against security issues, stay ahead of current cybersecurity trends, and ensure business continuity should systems be affected by an attack,” she told TechNewsWorld.

“Local government agencies are always going to be a target to attack because of their ability to affect large numbers of people,” she added. “The more people affected by an attack, the bigger the payout may be, if it’s a ransomware attack.”

Taken together, those factors make local governments especially attractive targets for cybercriminals.

Ransomware Becomes a Volume Business

A recent report by Comparitech found ransomware is a global problem for governments, with at least one attack on a government entity every day during the first half of this year. It added that global attacks increased 13% during that period over the second half of 2025, and that nearly a third (31%) of 2026 first-half attacks were in the United States.

“Comparitech’s numbers show the median demand on government entities fell to $100,000 in the first half of this year, a fifth of what it had been six months earlier,” pointed out Bob Maley, chief security officer at Black Kite, a cyber risk management and assessment company in Boston.

“I read that as attackers pricing to what a small municipality can actually come up with,” he told TechNewsWorld. “They’ve figured out the segment, and are running it like a volume business.”

He recalled the challenges of setting up a cybersecurity program when he was CISO of Pennsylvania. “The Commonwealth ran a major consolidation called Operation Secure Enterprise,” he explained. “Every agency had its own patching and monitoring, and the governor’s office wanted it brought under one roof.”

“You could have ordered the agencies to comply, and they would have found a hundred ways to slow-walk it,” he said. “What the administration did instead was create the funding to pay for the consolidation and manage it centrally, and I could not have done what I did there without that.”

“Almost no town or county gets that kind of deal,” he noted. “The mandate arrives with no clear funding source, which then leaves the expectation sitting on whatever IT staff already exists, usually one person, and she is already getting recruited every week by companies offering twice her salary.”

“She patches what she can reach and holds the rest together on a wing and a prayer, Band-Aids and bubblegum,” he added.

“The town council usually does care,” he continued, “but potholes just hold a better advantage in a budget fight. They get photographed. They get complained about at public meetings — and by Friday, somebody is standing next to fresh asphalt taking credit, while the security gap stays invisible right up until the day it empties the general fund.”

Alabama’s Statewide Cybersecurity Model

One state where towns and counties are getting a deal on cybersecurity is Alabama. It has established the Alabama Cybersecurity Intelligence Center, a joint initiative of the Alabama Office of Information Technology (AOIT) and Auburn University’s McCrary Institute for Cyber and Infrastructure Security. The center offers basic cyber hygiene, multi-factor authentication, penetration testing, incident response planning, and round-the-clock monitoring of every device on a municipal network.

The fundamental elements of the program, known as McCrary Secure, can be quickly deployed and are made possible through the State and Local Cybersecurity Grant Program (SLCGP), a US$19 million, five-year federal investment under the Biden Administration’s Infrastructure Investment and Jobs Act.

McCrary’s Chief Operating Officer Nick Sellers explained that for participating communities, the core McCrary Secure services come at no cost — that’s what the SLCGP funding is for. “Penetration testing, alone, to see how secure their current systems are is typically a five-figure engagement on the open market and is out of reach for most small municipalities,” he told TechNewsWorld.

“In Alabama, the average municipal IT shop is 2.2 people,” he noted. “That’s not a security team. That’s the people who also have to make sure everyone’s computer is working, connected to the printer, and their website is updated with the latest information.”

“Where cost enters is remediation,” he continued. “If an assessment finds an unsupported firewall or an end-of-life server, someone has to replace it. Some of that can be addressed through the grant. Some lands on the local budget.”

“Our approach is to rank findings by risk so a city with $20,000 knows which three things to fix first, rather than handing them a 200-page report they can’t act on,” he added.

“The most valuable thing we do fiscally may be translation,” he said. “When we put mayors and council members through a tabletop exercise, they see the exposure for themselves — and the IT director who’s been asking for funding for three years finally gets a yes.”

He noted that the tabletop exercises are effective because they reach decision-makers rather than technicians.

“A tabletop walks city and county leadership through a realistic worst-case scenario before it happens — the water system’s offline, billing is down, a reporter’s calling, and the person who knows the network is on vacation,” he explained. “Working through that in a conference room surfaces the gaps that don’t appear on any technical scan — who declares an incident, who talks to the public, who has authority to authorize emergency spending at 11 p.m.”

“We’ve had sessions recently where council members walked out saying they finally understood why their IT staff had been asking for money, and committed to funding it,” he said. “A vulnerability report rarely does that. Ninety minutes of sitting inside your city’s worst day does.”

Why Other States Should Follow

What Alabama is doing is correct, observed Shane Barney, chief information security officer at Keeper Security, a password management and online storage company in Chicago.

“Take the capabilities that no individual municipality can afford to build and deliver them centrally,” he told TechNewsWorld. “MFA [Multi-factor Authentication] enforcement, continuous monitoring, and penetration testing aren’t advanced security. They’re the baseline. The problem is that most local governments can’t reach the baseline alone. Statewide programs are one of the few mechanisms that can close that gap at scale.”

Matthew Hartman, chief strategy officer at Merlin Group, a Tysons Corner, Va.-based network of affiliates that invests in, enables, and scales cyber technology companies, agreed that statewide cybersecurity programs providing shared services, continuous monitoring, and incident response are among the most effective ways to raise the security baseline for smaller jurisdictions that cannot build these capabilities on their own.

“Cybersecurity should be treated as a shared responsibility, not something every municipality is expected to build from scratch,” he told TechNewsWorld.

Sachin Jade, CPO of Cyware, a provider of an AI-powered threat intelligence platform in Jersey City, N.J., maintained that the Alabama initiative could be a model for other states.

“By establishing a statewide collective defense model with automated threat intelligence sharing, states level the playing field for small municipalities that lack enterprise cybersecurity budgets by identifying and disseminating critical threat information in a timely fashion to enable municipalities to act,” he told TechNewsWorld.

“This is exactly the right model,” agreed Waseem Ahmed, head of engineering at Secure.com, a provider of AI security agents in Dubai, UAE. “Small towns cannot afford a SOC [Security Operations Center], a penetration tester or round-the-clock monitoring individually, but a state-level program can provide all of it at shared cost,” he told TechNewsWorld.

“MFA deployment, device monitoring, incident response planning — these are the controls that would have prevented most of the breaches in the Comparitech data,” he said. “More states need to follow Alabama’s lead. The alternative is waiting for the next county to pay a ransom.”

Statewide Programs Need Sustained Support

These types of programs are becoming more popular across the country, especially in states where smaller rural agencies, such as fire and police agencies or smaller government entities like water districts may not even have their own IT staff, let alone a team of security professionals that are trained and experienced in combating cyber attackers, added Nathan Wenzler, a field CISO at Optiv, a cybersecurity solutions provider headquartered in Denver.

“Conceptually, these programs are fantastic and can help provide shared resources that these organizations wouldn’t have otherwise,” he told TechNewsWorld, “but there are challenges with these programs as well. Like any other group, they are often underfunded and understaffed, and as demand across these smaller entities increases, the ability for these consortiums to monitor and respond effectively and quickly becomes impacted.”

He also pointed out that there can be increased risk to all of the agencies involved, because they must grant the central program access to their internal systems, data, and applications in order for that group to perform the monitoring and administration being offered. “This means that centers like this become a more attractive target for criminal actors, because a compromise to the center means that all connected entities can be compromised as well,” he said.

“It’s because of this that these centralized, shared service models need to be better funded and supported at state and federal levels to ensure that adequate cyber hygiene and strong security controls are in place and properly protecting all of the connected agencies utilizing these services,” he added.

Vendor Risk

Black Kite’s Maley warned that the layer that gets missed in coverage of local government is the vendor layer. “Counties do not run their own utility billing platforms, court records systems or payment portals,” he explained, “a handful of vendors do, and each of those vendors serves hundreds of jurisdictions.”

“Our research found that a single third-party breach produces 5.28 downstream victim organizations on average,” he continued, “so when one small city shows up in a breach headline, the more useful question is which vendor sits behind it and who else that vendor serves.”

Governance is also important when dealing with local government. The technology matters, but without leadership that takes ownership, none of it gets done consistently, argued Denis Calderone, principal and CTO at Suzu Labs, provider of AI-powered cybersecurity services in Las Vegas.

“What small governments need is someone at the top who instills a resilience mindset, the honest assumption that you will get hit and the plan to recover fast without paying,” he told TechNewsWorld. That mindset has to be operationalized, not just stated.

Get the leadership and accountability right, and the technical controls follow, he contended. Skip that, and you are just buying tools nobody is responsible for maintaining.

Bill Cameron, director for government services at the NCC Group, a global cybersecurity consultancy, maintained local governments should view cyber resilience as an operational priority rather than solely an IT issue. “Cyber incidents can disrupt essential services, directly affect residents and erode public trust,” he told TechNewsWorld.

“Ultimately, the most important message for local government leaders is that preparation matters,” he advised. “The question is rarely if an agency will face a cyber incident, but when. The ability to respond quickly, maintain critical services, and recover effectively is what determines long-term resilience.”