Government Ransomware Statistics
The services sector experienced 45 disclosed attacks (15%) and government experienced 30 disclosed attacks (10%) in Q2 2026.
In H1 2026, one government entity confirmed it paid a ransom while 16 government entities said they did not pay.
The median ransom demand in H1 2026 was $100,000, which is one-fifth of the H2 2025 median of $500,000.
The United States accounted for 31% of government ransomware attacks in H1 2026, with 58 of the 187 attacks, representing a 23% decline from 75 attacks in H2 2025.
From H2 2025 to H1 2026, France’s government-targeted attacks declined by 20%, Germany’s increased by 13%, and South Africa’s increased by 50%.
The ransomware group The Gentlemen claimed 22 attacks on government agencies in H1 2026, up from a single claimed attack in H2 2025.
The Gentlemen made 504 attack claims in total across sectors in 2026 so far.
Ten entities targeted by The Gentlemen in 2026 had confirmed attacks.
Ransomware attacks on government entities increased by over 13%, rising from 165 to 187 attacks between H2 2025 and H1 2026.
H1 2026 had 187 ransomware attacks on government entities in total, with 89 confirmed attacks and 98 unconfirmed attacks.
Confirmed ransomware attacks on government entities involved 179,000 known breached records in H1 2026.
The strains with the most confirmed attacks on government entities were The Gentlemen (10), Qilin (9), LockBit (7), and INC (6).
Lørenskog kommune in Norway faced a $1.18 million ransom demand.
Secretaria de Estado de Saúde de Mato Grosso in Brazil faced a $500,000 ransom demand and said the hackers’ claim of 200 TB stolen was likely exaggerated.
Germany recorded 9 attacks, France recorded 8 attacks, and South Africa recorded 6 attacks on government entities in H1 2026.
Of US government-targeted attacks in H1 2026, 33 were confirmed; Germany had 7 confirmed attacks; Italy and Spain each had 4 confirmed attacks.
LockBit’s attacks on government agencies increased by 250%, rising from 4 in H2 2025 to 14 in H1 2026, with seven of those attacks confirmed.
From H2 2025 to H1 2026, ransomware attacks in the US declined across all sectors by 8%.
German municipal transport company Verkehrsgesellschaft Main-Tauber took 11 weeks to recover from its January 2026 ransomware attack.
From January to June 2026, an average of one ransomware attack on a government entity occured every day.
The most prolific ransomware strains by number of claims against government organizations were The Gentlemen (22), Qilin (21), LockBit (14), APT73/BASHE (12), and INC (10).
Murray County in the US paid $200,000 in May 2026 to prevent data from being released.
Winona County notified 6,196 people of a breach following its January 2026 attack.
Most government agencies take an average of about four months to notify victims of data breaches following ransomware attacks.
The largest known ransom demand against a government entity in H1 2026 was $3.1 million against the Land and Agricultural Development Bank of South Africa.
Qilin’s attacks on government entities fell 45%, decreasing from 38 in H2 2025 to 21 in H1 2026, with nine of those attacks confirmed.
Passaic County, New Jersey received an $800,000 ransom demand in March 2026.
Latvia’s forestry company Latvijas valsts meži (LVM) faced a ransom demand of $686,300 after a June 2026 attack.
72% of local and state government organizations paid the ransom, the highest payment rate among sectors.
Government entities experienced 32 publicly disclosed ransomware attacks (12%) and the technology sector experienced 28 attacks (11%) in Q1 2026.
The government sector reported 28 ransomware attacks in Q3 2025.
The healthcare, government, and technology industries together represented 53% of all publicly disclosed ransomware activity during Q3 2025.
10% of organizations in the government sector experienced ransomware incidents annually.
65% of organisations in local government were affected by ransomware.
The government sector was the second most targeted for ransomware, with 45 publicly disclosed attacks between April - June 2025.
State and local government reported the highest median ransom payment at $2.5 million.
Average ransom per attack on state, local, tribal, and territorial (SLTT) governments reached $872,656 between 2018 and December 2024, with total costs exceeding $1.09 billion.