Industries · Public Sector
Ransomware protection for the public sector
The public sector runs the services communities cannot live without: clean water, public transit, schools, hospitals, courts, emergency response, and the city and county systems that keep daily life moving. Ransomware groups target all of them, because downtime hurts the public immediately and the pressure to restore service is enormous. When SamSam hit the City of Atlanta in 2018, recovery cost around $17 million, and when Rhysida hit the British Library in 2023 the recovery bill reached about £7 million, roughly 40% of its reserves. We keep public services running through an attack by detecting in seconds, containing before spread, and self-healing critical systems from immutable backups.
We add the resilience layer public-sector organizations need: enterprise-grade detection and automated containment for lean IT teams, data kept sovereign through on-premises deployment, and validated recovery that restores services in priority order so the public is not left waiting.
Why ransomware hits public sector hardest
Public-sector organizations have become a favored ransomware target at every level, from national agencies to counties, cities, and the special districts that run water, transit, and schools. Attacks have forced cities offline, shut public institutions for months, and triggered states of emergency. The reason is simple: when a public service goes dark, the disruption is immediate and visible, which gives an extortionist maximum leverage, and many public bodies run tight budgets and legacy systems with lean IT teams.
This page covers the broad public sector and its many infrastructure types. If you run a federal, state, or municipal government agency specifically, we also have a dedicated page on ransomware protection for government agencies. Everywhere across the public sector, the shared requirement is the same: keep critical services available through an attack, keep citizen data sovereign, and recover fast enough that the public barely notices. That is a resilience problem, and resilience is what we are built to deliver.
Why the public sector is hit so hard, and so often
Ransomware groups follow leverage and soft targets, and the public sector offers both. A city that cannot issue permits, a water utility that loses its billing and control systems, a school district that cannot open, a court that cannot process cases, all create immediate public pressure to pay or restore at any cost. At the same time, public bodies frequently run on constrained budgets, aging infrastructure, and small security teams, which is exactly the profile attackers probe for. The SamSam group that crippled Atlanta specifically hunted for weak, internet-exposed systems.
The consequences are severe and well documented. Atlanta's 2018 attack cost roughly $17 million to recover from, far more than the ~$50,000 ransom demanded. The British Library refused Rhysida's ransom in 2023 and still spent about £7 million, nearly 40% of its reserves, with services degraded for the better part of a year. On average, government entities suffer around a month of downtime after a ransomware attack, and that downtime falls directly on residents who depend on public services.
Operational technology makes public infrastructure uniquely dangerous to attack
Much of the public sector does not just process data, it runs physical infrastructure through operational technology (OT): the control systems behind water treatment, transit signaling, traffic management, and building systems. When American Water, the largest regulated US water utility serving about 14 million people across 14 states, found unauthorized activity on its network in October 2024, it took billing systems offline for about a week as a precaution to protect plants it had no evidence the intruder had reached. A separate incident forced an Arkansas City water plant into manual operation.
This is the heart of the public-sector challenge. OT systems often cannot run a security agent and cannot simply be shut down, because the service they control is essential. A passive assessment of more than a thousand US drinking-water systems serving over 193 million people found that a quarter had security defects that could enable disruption. Protecting the public sector therefore means protecting both the data systems and the operational systems, at the network level, without forcing the kind of precautionary shutdown that becomes its own crisis.
By the numbers
The ransomware threat to public sector, in figures
The scale of the ransomware threat to the public sector, in figures from public reporting and research.
By infrastructure type
How we protect each part of the public sector
The public sector is not one thing. A water utility, a school district, a courthouse, and a transit agency each face a different version of the ransomware threat and run different systems. Here is how we protect each, and what we keep running when an attack lands.
Cities, counties & local government
Permitting, records, payments, 311, and the back-office systems residents touch every day. A municipal attack like Atlanta's can freeze all of it at once.
- Resident-facing and records systems
- Finance, payments, and permitting
- Priority-order recovery so core services return first
Water & wastewater utilities
Billing and customer systems alongside the operational technology that treats and moves water. We protect the IT/OT boundary so an intrusion cannot cross into control systems, as the American Water and Arkansas City incidents warned.
- IT/OT boundary protection
- Agentless coverage for control systems
- Containment that avoids precautionary shutdowns
Transit & transportation
Scheduling, fare, and signaling systems that move a city. We isolate a threat fast and keep operational systems available so service does not stop.
- Operational and fare systems
- Network-level detection across mixed estates
- Fast, validated recovery
Schools & school districts
Student information systems, learning platforms, and the thin IT teams that run them. We give districts enterprise-grade protection and can run it as a managed service.
- Student-information and learning systems
- Open, device-heavy network coverage
- Managed option for lean IT teams
Public health & hospitals
Public hospitals and health departments hold sensitive records and run device-heavy clinical environments. We cover the agentless medical devices endpoint tools cannot reach and recover clinical systems in care-priority order.
- Agentless medical-device coverage
- Care-gated containment
- EHR-first recovery
Courts & justice
Case-management and records systems whose downtime delays justice directly. We keep them available and preserve a tamper-proof record of any incident.
- Case-management and records systems
- Immutable audit for the record
- Rapid, validated recovery
Emergency services & public safety
Dispatch, 911, and police and fire systems where downtime is a public-safety emergency. We contain in seconds with high-impact actions gated for human approval.
- Dispatch and emergency systems
- Seconds-scale automated containment
- Always-on, around-the-clock coverage
Libraries, cultural & research institutions
Catalogues, digital collections, and the staff and user data behind them, the exact targets Rhysida hit at the British Library. We detect exfiltration before it completes and recover clean.
- Catalogue and collection systems
- Exfiltration detection for double extortion
- Immutable, air-gapped recovery
Our solution
How Immune protects public-sector organizations
Immune's detect, contain, and self-heal platform, tailored to the realities of public sector.
Citizen-service continuity
Keeps critical public services available through an attack, with priority-order recovery.
Data sovereignty
On-premises deployment keeps sensitive citizen data under public control.
IT/OT boundary protection
Protects the operational systems behind water, transit, and building infrastructure.
Legacy-system coverage
Network-level detection and containment for the legacy systems the public sector runs.
Managed option for lean teams
Enterprise-grade detection, containment, and recovery, run for you if you have no security staff.
Automated containment
Isolates threats in seconds to keep an incident from becoming a city-wide outage.
Immutable audit
Tamper-proof logging that supports transparency, reporting, and investigation obligations.
Fast, validated recovery
Restores services from verified, immutable backups in priority order.
See it in action
The Immune console, working on a public sector environment
Continuous monitoring across public-sector IT and OT networks
Automated containment stops a city-wide or utility-wide spread in seconds
Self-healing recovery restores essential public services first, validated clean
The solution, in depth
How we actually protect public-sector organizations, in technical terms
Public-sector buyers want to know exactly how the protection works before they commit scarce budget, so here is the mechanism, piece by piece. The product is the same one we run everywhere; what follows is how it applies to the systems and constraints specific to public services.
We protect both the data systems and the operational systems
Most of the public sector runs two kinds of system: the data systems that hold records and process payments, and the operational technology that runs physical infrastructure like water treatment, transit signaling, and building controls. We watch both at the network level. For OT, that matters enormously, because those control systems usually cannot run a security agent and cannot be taken offline casually. We detect a threat heading for them and contain it at the network boundary, so an intrusion that starts in IT, where most do, cannot cross into the systems that keep water flowing or trains running.
We give lean public-sector teams enterprise-grade protection
The hard truth behind many public-sector attacks is a small IT team and no dedicated security staff. We are built for that. Detection, containment, and recovery are automated, so the platform does the heavy lifting around the clock, and we can run the whole thing for you as a managed service. A city, district, or utility gets the same resilience a large enterprise would, without needing to hire a security operations center it cannot afford.
- Automated detection and containment, no large team required
- Managed service option for organizations with no security staff
- Broad network-level coverage without an agent on every device
We keep sensitive citizen data sovereign
Public bodies hold residents' most sensitive data and operate under transparency and data-governance rules that a commercial cloud deployment can complicate. Immune can run as a managed service, in a hybrid model, or entirely on-premises and air-gapped, including the analysis engine. That means ransomware resilience without sending citizen data to a third party, and it fits the sovereignty expectations the public sector operates under.
We detect data theft before it becomes a public leak
Modern public-sector attacks are double extortion: the data is stolen before anything is encrypted, then threatened with public release, which is exactly what Rhysida did when it leaked 600GB from the British Library. The race is to catch the theft while it happens. Our network-level detection and deception surface the large, abnormal outbound transfers and the reconnaissance that precede exfiltration, so the goal is to stop residents' data from leaving rather than to discover the loss on a leak site.
We recover fast, clean, and in the order the public needs
When an attack gets through, what decides the outcome is how fast and how cleanly you recover, and in what order. We keep verified, immutable, air-gapped backups that ransomware cannot alter or delete, because attackers target ordinary backups first. We confirm a backup predates the attack, verify it is clean, and restore services in priority order so the systems the public depends on most come back first. That capability is what lets a public body refuse to pay, the way Atlanta and the British Library did, instead of funding the attacker to get its own services back.
The technical flow, step by step
We place network sensors across your IT and OT estate and lightweight agents where they fit, on-premises or hybrid, with a managed option if you have no security staff.
Over about two weeks we learn what normal looks like across your resident-facing systems, back office, and any operational technology.
Deception traps, entropy signals, abnormal data transfers, and a credential behaving out of character each raise a high-confidence signal in seconds.
The AI fuses the signals into one plain-language verdict with a confidence score and blast radius, so a small team knows exactly what is happening.
We isolate the affected systems and tighten segmentation in about thirty seconds to stop a city-wide or utility-wide spread, with high-impact and safety-critical actions gated for approval.
We restore from verified, immutable backups in priority order, validated clean, so essential public services come back first and fast.
A tamper-proof, hash-chained audit trail documents the whole response for transparency, oversight, and any investigation that follows.
Compliance
Aligned to public sector regulation
Our controls map to the compliance and operational-resilience expectations placed on public-sector organizations.
CISA guidance & critical-infrastructure expectations
US public bodies and critical-infrastructure operators are expected to follow CISA #StopRansomware guidance. Our detect-contain-heal loop and immutable audit support those resilience expectations.
Sector rules (water, transit, health)
Water utilities, transit agencies, and public health bodies face sector-specific security and continuity expectations. Our IT/OT protection and validated recovery map to them.
Data-protection & breach notification
Public bodies must notify residents of breaches of personal data. Clear, tamper-proof incident records support an accurate, defensible determination.
Transparency & records obligations
Public-sector transparency and records-retention rules require a trustworthy account of what happened. Our hash-chained audit log provides exactly that.
Use cases
Where Immune protects public-sector organizations
Municipal service attack
Contain a threat before it takes an entire city or county's services offline.
Water / utility OT intrusion
Stop an IT intrusion from crossing into the control systems that run essential infrastructure.
School-district attack
Keep learning systems available and recover fast, even with a lean IT team.
Public-health / hospital attack
Protect agentless medical devices and restore clinical systems in care-priority order.
Double-extortion data theft
Detect exfiltration of residents' data in progress and recover cleanly to remove leverage.
Emergency-services disruption
Contain in seconds to keep dispatch and public-safety systems running.
Real incidents
Public Sector ransomware attacks: what really happened
The public sector does not have to imagine a ransomware attack. Cities, libraries, and water utilities have all lived through serious incidents. The examples below are real and publicly reported, with sources, and together they show how broadly the threat reaches across public services.
City of Atlanta (SamSam ransomware)
March 2018The SamSam group crippled municipal services across the City of Atlanta, taking down resident-facing systems for days. The attackers demanded roughly $50,000, but recovery ultimately cost the city around $17 million. Two Iranian nationals were later indicted. It remains one of the most-studied municipal ransomware attacks.
Source: StateScoop / Wired / U.S. DOJ
British Library (Rhysida ransomware)
October 2023Rhysida attacked the British Library, exfiltrated about 600GB of staff and user data, and took its catalogue, Wi-Fi, and website offline. The library refused the roughly £600,000 (20 bitcoin) ransom, so the data was leaked, and recovery cost about £7 million, nearly 40% of its reserves, with services degraded for much of the following year.
Source: Dark Reading / Wikipedia / The Guardian
American Water (largest US water utility)
October 2024American Water, which serves about 14 million people across 14 states and at least 18 military installations, found unauthorized activity on its network and took billing and other systems offline for about a week as a precaution. The company said water and wastewater services appeared unaffected, a reminder of how close the threat came to operational systems.
Source: CyberScoop / CNBC / Dark Reading
US drinking-water systems (sector assessment)
2024A passive assessment of more than 1,000 US drinking-water systems serving over 193 million people found that about a quarter had security defects that could enable disruption, denial of service, or data compromise, and CISA has repeatedly warned water facilities to secure exposed systems.
Source: SecurityWeek / BleepingComputer / CISA
Common questions
Ransomware protection for public sector, answered
+Can Immune keep public-sector data sovereign?
Yes. We can deploy Immune on-premises or air-gapped, including the analysis engine, so sensitive citizen data stays under public control while we deliver full detection, containment, and self-healing recovery.
+Does Immune protect the operational technology behind water and transit?
Yes. We protect the IT/OT boundary with network-level detection and containment, reaching the control systems that cannot run a security agent, so an IT intrusion cannot cross into the systems that run essential infrastructure.
+How quickly can Immune restore public services?
Our self-healing recovery restores services from verified, immutable backups in priority order, aiming to bring critical citizen-facing systems back in a controlled window of hours rather than the month of downtime government attacks often take.
+Is Immune practical for a public body with a small IT team?
Yes. Detection, containment, and recovery are automated, and we can run the entire platform for you as a managed service. A city, district, or utility gets enterprise-grade resilience without having to build a security operations center it cannot afford.
+What is the difference between this page and the government page?
This public-sector page covers the broad set of public services, including water and utilities, transit, schools, public health, courts, libraries, and emergency services. Our government page focuses specifically on federal, state, and local government agencies. Many organizations will find both relevant.
+How does Immune help the public sector avoid paying a ransom?
Independent recovery is what removes an attacker's leverage. Because we keep verified, immutable, air-gapped backups and restore in priority order, a public body can recover on its own, as Atlanta and the British Library chose to do, rather than funding the attacker to get its services back.
+Can Immune cover a mix of modern and legacy public-sector systems?
Yes. We protect at the network level, so we defend legacy systems that cannot host an agent alongside modern ones, which suits the mixed estates common across public services.
References
Sources and further reading
Every incident and figure on this page is drawn from public reporting. The primary sources are listed below.
- 1.StateScoop: One year after Atlanta's ransomware attack
- 2.U.S. DOJ: Iranian nationals charged for the City of Atlanta ransomware attack
- 3.Dark Reading: Key takeaways from the British Library cyberattack
- 4.CyberScoop: American Water says it was hit with cyberattack
- 5.SecurityWeek: 300 drinking-water systems exposed to disruptive hacker attacks
- 6.CISA: #StopRansomware guidance
Other industries
Ransomware protection for other industries
Immune protects critical systems across sectors. Explore ransomware protection tailored to other industries.
Explore the platform
Related capabilities
Keep your public sector operation running through ransomware
See how Immune detects, contains, and self-heals critical systems for public-sector organizations.