Municipal ransomware protection: a guide for cities, counties, and local government

Why local government is such a frequent target

Ransomware groups are opportunistic, and local governments tick every box they look for. A city or county holds a dense trove of personal and financial data on residents, runs services that cannot simply be switched off, from 911 dispatch and water billing to courts and permitting, and typically does it on constrained budgets with aging systems and a small IT team. That combination means both a strong incentive to pay quickly and a comparatively soft target, which is exactly why attackers return to the sector year after year.

The scale of the problem is not anecdotal. Year after year, hundreds of US state and local government entities report ransomware incidents, and the trend has not reversed. For an attacker weighing effort against payout, a mid-sized city with a flat network and essential public services is a far easier mark than a hardened bank, and the pressure on officials to restore services fast makes extortion more likely to succeed.

What the landmark attacks actually cost

The clearest way to understand municipal ransomware risk is to look at what has already happened to cities that were not ready. The incidents below are among the most consequential on record, and each one carries a specific lesson for local government.

• Atlanta, 2018: a SamSam ransomware attack crippled city systems for days, took down court and payment services, and recovery costs reportedly ran to roughly $17 million, far more than the ransom demanded.
• Baltimore, 2019: the RobbinHood attack locked up city systems for weeks, froze property transactions and billing, and cost the city an estimated $18 million or more in recovery and lost revenue.
• Oakland, 2023: a ransomware attack led the city to declare a local state of emergency, disrupted services for weeks, and exposed data that attackers later leaked.
• City of Columbus, 2024: a Rhysida attack exposed the data of roughly 500,000 residents and prompted Ohio to introduce new cybersecurity requirements for local governments.

The pattern behind the headlines

Read across those incidents and the same shape appears. An attacker gets an initial foothold, often through an exposed remote-access service or a stolen credential rather than dramatic malware, then moves laterally across a network that was never segmented, encrypting and stealing as it goes. Because many municipal networks are flat, a single compromised machine can reach payroll, court records, and public-safety systems alike. And because backups were frequently connected to that same network, attackers encrypted or deleted them first, leaving the city with no clean path back and a hard choice about paying.

The cost that follows is rarely the ransom itself. It is the weeks of downtime, the manual workarounds, the overtime, the forensic and legal bills, the resident-notification costs, and the lasting erosion of public trust. Atlanta and Baltimore both spent far more recovering than the attackers ever asked for, which is the single most important lesson for any municipality: the economics of prevention and resilience are overwhelmingly favorable compared with the economics of recovery.

The payment question has changed

For years, the quiet fallback for a cornered city was to pay and move on. That option is closing. A growing number of US states have passed laws restricting or outright banning ransom payments by public bodies, and following the Columbus attack, Ohio moved to require local governments to run cybersecurity programs and obtain approval before paying. Federal guidance from CISA consistently discourages payment, because it funds the next wave of attacks and does not guarantee clean recovery.

The practical consequence for local government is unavoidable: if paying is restricted or prohibited, then the ability to recover independently is no longer a best practice, it is the plan. A municipality has to be able to restore its own services from backups an attacker could not reach, or it has no plan at all.

What municipal ransomware protection actually requires

Local governments do not need a bigger version of an enterprise security program. They need a focused one built around the realities of running public services with a lean team. In practice that comes down to a handful of capabilities.

• Automated containment: the ability to isolate a compromised machine or segment in seconds, around the clock, without waiting for a small team to notice an alert at 2am.
• Network segmentation: so an intrusion in one department cannot reach public-safety, finance, and court systems across a flat network.
• Independent, immutable recovery: verified, air-gapped backups an attacker cannot encrypt or delete, so services come back without paying.
• Behavioral detection: catching the stolen-credential and remote-access intrusions that signature tools wave through, since that is how most municipal attacks begin.
• Immutable audit records: clear, tamper-proof evidence for state breach-notification and the new cybersecurity-program requirements many states now impose.
• A managed option: for the many cities and counties that cannot staff a 24/7 security operation, a service that runs detection and response for them.

How we help cities and counties stay running

We built our platform around resilience rather than prevention alone, which is exactly what a local government needs when the goal is to keep services running through an attack and recover without paying. We detect an intrusion in seconds using behavior rather than signatures, contain it automatically before it can spread across departments, and self-heal critical systems from immutable, air-gapped backups. For a city or county without a dedicated security team, we can run it as a managed detection and response service, and everything can run on-premises so resident data stays under your control.

For the full sector picture, see our ransomware protection for the public sector, which covers the breadth of government infrastructure, and our ransomware protection for government agencies. Whatever tooling a municipality chooses, the test is the same one Atlanta and Baltimore failed and Columbus is still recovering from: when an attack lands, can you contain it fast and bring your own services back without paying. Build for that answer before you need it.