Report by Comparitech
Government Ransomware Roundup: H1 2026 stats on attacks, ransoms, and data breaches
Key Findings
In H1 2026, one government entity confirmed it paid a ransom while 16 government entities said they did not pay.
The median ransom demand in H1 2026 was $100,000, which is one-fifth of the H2 2025 median of $500,000.
The United States accounted for 31% of government ransomware attacks in H1 2026, with 58 of the 187 attacks, representing a 23% decline from 75 attacks in H2 2025.
From H2 2025 to H1 2026, France’s government-targeted attacks declined by 20%, Germany’s increased by 13%, and South Africa’s increased by 50%.
The ransomware group The Gentlemen claimed 22 attacks on government agencies in H1 2026, up from a single claimed attack in H2 2025.
The Gentlemen made 504 attack claims in total across sectors in 2026 so far.
Ten entities targeted by The Gentlemen in 2026 had confirmed attacks.
Ransomware attacks on government entities increased by over 13%, rising from 165 to 187 attacks between H2 2025 and H1 2026.
H1 2026 had 187 ransomware attacks on government entities in total, with 89 confirmed attacks and 98 unconfirmed attacks.
Confirmed ransomware attacks on government entities involved 179,000 known breached records in H1 2026.
The strains with the most confirmed attacks on government entities were The Gentlemen (10), Qilin (9), LockBit (7), and INC (6).
The City of Suffolk, Virginia breach affected 157,725 people in February 2026.
İzelman A.Ş. (İzmir municipal parking service) reports that 10,000 people may have been impacted in its March 2026 breach.
The City of Middletown, Ohio began notifying 123,791 people of a breach originating in July 2025.
Lørenskog kommune in Norway faced a $1.18 million ransom demand.
Secretaria de Estado de Saúde de Mato Grosso in Brazil faced a $500,000 ransom demand and said the hackers’ claim of 200 TB stolen was likely exaggerated.
Germany recorded 9 attacks, France recorded 8 attacks, and South Africa recorded 6 attacks on government entities in H1 2026.
Of US government-targeted attacks in H1 2026, 33 were confirmed; Germany had 7 confirmed attacks; Italy and Spain each had 4 confirmed attacks.
LockBit’s attacks on government agencies increased by 250%, rising from 4 in H2 2025 to 14 in H1 2026, with seven of those attacks confirmed.
From H2 2025 to H1 2026, ransomware attacks in the US declined across all sectors by 8%.
German municipal transport company Verkehrsgesellschaft Main-Tauber took 11 weeks to recover from its January 2026 ransomware attack.
From January to June 2026, an average of one ransomware attack on a government entity occured every day.
The most prolific ransomware strains by number of claims against government organizations were The Gentlemen (22), Qilin (21), LockBit (14), APT73/BASHE (12), and INC (10).
Murray County in the US paid $200,000 in May 2026 to prevent data from being released.
Winona County notified 6,196 people of a breach following its January 2026 attack.
Most government agencies take an average of about four months to notify victims of data breaches following ransomware attacks.
The largest known ransom demand against a government entity in H1 2026 was $3.1 million against the Land and Agricultural Development Bank of South Africa.
Qilin’s attacks on government entities fell 45%, decreasing from 38 in H2 2025 to 21 in H1 2026, with nine of those attacks confirmed.
Passaic County, New Jersey received an $800,000 ransom demand in March 2026.
Latvia’s forestry company Latvijas valsts meži (LVM) faced a ransom demand of $686,300 after a June 2026 attack.