Government agencies have become one of the most heavily targeted sectors in cybersecurity, and the numbers back it up in an uncomfortable way. State and local governments paid the highest median ransom ($2.5 million) of any sector tracked in 2025, and when ransomware does hit a government network, it results in encrypted data nearly every time. Even agencies that refuse to pay don’t escape the cost. Baltimore spent between $10 and $18 million recovering from a 2019 ransomware attack it never paid a ransom for; Atlanta spent roughly $17 million doing the same. State and local ransomware attacks jumped 65% in early 2025 alone, and a growing share now arrive through a third party (a vendor, a contractor, a shared IT provider) rather than a direct hit on the agency itself. Attackers target government because disrupting a city’s systems creates enormous pressure to pay, fast, and the sensitive citizen data behind those systems is worth exploiting either way.