Nearly One Attack Every Day

The 187 reported incidents amount to roughly one government ransomware attack every day during the first six months of 2026.

However, the numbers should be interpreted carefully. Only 89 of the incidents were confirmed by the affected organizations themselves. The remaining 98 were based primarily on claims made by ransomware groups on their leak sites.

That distinction matters because ransomware groups sometimes make claims that cannot immediately be independently verified.

The United States Was the Most Targeted

The United States accounted for 58 of the reported government ransomware incidents—approximately 31% of the global total.

Other heavily affected countries included Germany, with nine incidents; France, with eight; and South Africa, with six.

Interestingly, the number of U.S. government ransomware incidents actually declined by approximately 23% compared with the second half of 2025. The global increase was therefore driven by activity in other countries rather than by a surge in U.S. attacks.

Ransomware Groups Are Targeting More Victims

The most active ransomware groups identified in the report included The Gentlemen, with 22 claimed government attacks, followed by Qilin with 21 and LockBit with 14.

The pattern suggests that ransomware continues to operate as a highly scalable criminal business. Attackers do not necessarily need to compromise a small number of extremely valuable organizations. They can instead target a much larger number of government entities, including smaller municipalities and agencies.

Ransom Demands Fell Dramatically

One of the most interesting findings is that the median ransom demand dropped substantially.

The median demand fell from approximately $500,000 during the second half of 2025 to about $100,000 during the first half of 2026.

That does not necessarily mean ransomware has become less profitable or less damaging.

Instead, it may indicate a shift toward higher-volume, lower-value attacks. Attackers can potentially make money by compromising more organizations and demanding smaller payments from each victim.

For smaller government organizations, even a $100,000 demand can represent a significant financial burden.

Data Theft Adds Another Layer of Damage

Ransomware attacks are no longer simply about encrypting computers and demanding payment to restore access.

Attackers increasingly steal information before encrypting systems and then threaten to publish the data.

The research identified nearly 179,000 compromised records associated with confirmed government ransomware incidents during the first half of 2026.

The largest reported breach involved the City of Suffolk, Virginia, where approximately 157,725 people were affected.

Why Government Attacks Matter

A ransomware attack against a government organization can have consequences far beyond the victim's IT department.

Successful attacks can disrupt:

• Public services

• Government operations

• Citizen records

• Administrative systems

• Public-facing websites

• Sensitive information

The impact can therefore extend directly to citizens who depend on government services.

A municipality may not possess the financial resources or cybersecurity staff of a large corporation, yet it can still operate systems containing valuable personal information and critical public services.

The Bigger Picture

The 13% increase should not be interpreted as evidence of a sudden global ransomware explosion. The number of incidents fluctuates considerably from one reporting period to another, and some reported attacks remain unconfirmed.

The more significant finding is the persistence and scale of the threat.

Government organizations experienced approximately one reported ransomware incident per day during the first half of 2026, while attackers increasingly appear willing to pursue a larger number of victims for smaller ransom demands.

The decline in median ransom demands may actually reinforce this trend: ransomware operators can potentially make their campaigns more scalable by targeting organizations that cannot afford extensive security defenses or prolonged operational disruption.

Bottom Line

The first half of 2026 demonstrates that ransomware remains a persistent threat to government organizations worldwide.

The headline number—a 13% increase to 187 incidents—is important, but the underlying trend is more significant: government ransomware is becoming a high-volume, scalable threat that combines system disruption, data theft and extortion.

For governments, the lesson is clear. Cybersecurity cannot focus solely on preventing the initial intrusion. Organizations also need strong identity protection, rapid patching, network monitoring, reliable backups, incident response plans and the ability to quickly contain an attacker who gains access.

Ransomware does not have to bring down an entire government to be successful. Disrupting a single critical service, exposing sensitive citizen information or forcing a small municipality offline can be enough to create significant real-world consequences.