Almost three-quarters of state and local government victims of ransomware attacks in 2021 ended up having their data encrypted by the hackers.

The figure, 72%, is 7% higher than the public/private cross-sector average, according to the State of Ransomware in State and Local Government 2022 survey issued by software company, Sophos.

That rate of encryption is one of the worst experienced across multiple sectors, reflecting poorly on governments’ preventative and response capabilities.

To make matters worse, victim organisations often ended up forking out far more dollars to recover from the situation than the hackers were seeking in their ransom demands.

“If we look at what happened with the city of Atlanta, Georgia, back in 2018, they ultimately ended up paying US$17 million to recover from an attack that asked for US$50,000 dollars in ransom,” said Chester Wisniewski, principal research scientist with Sophos.

In addition, the survey reveals that only 20% of state and local governments were able to halt a ransomware attack before their data could be encrypted.

“Traditionally, government organisations haven’t been prime targets for ransomware attackers, since they don’t have as much money as traditional businesses, and criminal groups are reticent to attract attention from law enforcement,” said Wisniewski.

“However, when these organisations do get hit, they have little in the way of protection because they don’t have the budget for additional, in-depth cybersecurity support, including threat hunting teams or security operations centres.”

The ransomware survey, which encompassed 5,600 IT professionals across 31 countries, including 199 in the state and local government sector, also found that in 2021:

• The government sector experienced a drop in the amount of encrypted data recovered after paying a ransom (58%) when compared to 2020 (70%).
• There was a 70% rise in the number of attacks against local government; 58% of those attacks were targeted (compared to 34% in 2020).
• The cost to remediate an attack was three times the average ransom paid.