Public sector data breach costs rose 22% to $3.5 million in 2026, the steepest year-over-year increase of any industry IBM's Cost of a Data Breach Report tracks, published July 29, 2026. Government remains the least expensive sector in dollar terms, but the direction of that 22% jump stands out against a year when several other industries, retail and financial services among them, rose in the single digits or low teens.
Below is how that cost increase compares to other sectors, how government ransomware attack volume has trended through 2025 and 2026, what a typical ransom demand looks like, and what a major recent government breach cost in practice.
Why did government breach costs jump 22% in a single year?
Public sector's $3.5 million average cost in 2026 is still the cheapest of any industry IBM tracks, behind retail's $3.8 million and well below healthcare's $6.64 million, but the 22% increase outpaces every sector except communications, which rose 26%. Most other industries posted single-digit to low-teens increases, and healthcare was the only sector where average cost fell, down 11%.
Figure 1: Year-over-year change in average breach cost by industry, 2026. Source: IBM Cost of a Data Breach Report 2026.
IBM's report attributes government's outsized increase largely to the sector's chronic underinvestment in detection and response relative to private industry, which tends to draw out incidents and drive up recovery costs once a breach does happen. If your agency or government contractor handles resident or constituent data, you can generate a privacy policy that documents what personal data you collect, how long you keep it, and how you will notify the public if it is exposed, disclosures state open-records and breach-notification laws expect first.
How many ransomware attacks are hitting government targets?
Government ransomware attack volume has climbed steadily through 2025 and into 2026. Comparitech logged 208 ransomware incidents against government entities worldwide in the first half of 2025, a 65% jump from the 126 recorded in the same period of 2024. Between January and September 2025, the total reached 276 attacks, up 41% from 196 in the same nine-month window the year before.
Figure 2: Global government ransomware attacks by half-year, H1 2025 through H1 2026. Source: Comparitech government ransomware tracking.
That pace continued into 2026: the first half of the year logged 187 attacks, up 13% from 165 in the second half of 2025, of which only 89 were confirmed by the affected organization, averaging roughly one confirmed-or-claimed incident per day worldwide. The United States accounted for 58 of those 187 attacks, 31% of the global total, the largest share of any single country.
Figure 3: Share of H1 2026 global government ransomware attacks originating in the United States versus the rest of the world. Source: Comparitech government ransomware tracking.
The average ransom demand against a government target is $872,656, based on a Comparitech study of 525 attacks on government organizations, a figure that sits well below the multimillion-dollar demands seen in financial services or retail but still represents a meaningful budget hit for a cash-strapped local agency.
Figure 4: The compliance path a government agency follows after a resident-data breach. Source: State breach-notification statutes, as typically structured for public-sector entities.
What did a recent major government breach look like?
The clearest recent example of government's exposure is the breach disclosed in March 2026 at the Los Angeles City Attorney's Office, which compromised 7.7 terabytes of data across more than 337,000 files, including Los Angeles Police Department records. The scale of that single breach, both in raw data volume and in the sensitivity of the records involved, illustrates why government incidents can generate outsized recovery and legal costs even when the per-breach dollar average looks modest next to private industry.
Figure 5: Recent landmark government data incidents and cost trends, 2025 to 2026. Source: Industrial Cyber, IBM.
The Bottom Line
Government breaches remain cheaper on average than nearly every other sector, but the direction of travel is the story: a 22% cost jump, a ransomware attack pace that now averages roughly one incident a day worldwide, and single incidents like the LA City Attorney's Office breach that expose terabytes of sensitive records at once. Because so much of what government agencies hold is either legally public-facing or covered by state notification law, the operational and legal fallout from a breach can extend well beyond the direct incident-response cost that IBM's average figure captures. Any agency or contractor handling resident data needs breach-notification language that matches its specific state's requirements, not a generic policy borrowed from private industry.
Frequently Asked Questions
How much does a government data breach cost on average? $3.5 million in 2026, up 22% from the year before, according to IBM's Cost of a Data Breach Report 2026. That is the steepest year-over-year cost increase of any industry IBM tracks, even though public sector remains the least expensive sector in dollar terms.
How many ransomware attacks hit government targets in 2025? 276 ransomware attacks against government entities worldwide between January and September 2025, a 41% increase from 196 during the same period in 2024, according to Comparitech's tracking, which logged 208 attacks in the first half of 2025 alone.
How many government ransomware attacks happened in the first half of 2026? 187 attacks, up 13% from 165 in the second half of 2025, averaging roughly one confirmed-or-claimed government ransomware incident per day. The United States accounted for 58 of those attacks, 31% of the global total, the largest share of any country.
What is the average ransom demand against a government target? $872,656, based on a Comparitech study of 525 attacks on government organizations.
This is one entry in a broader look at data breach trends: see Data Breach Statistics 2026: Key Facts and Global Figures for the full industry picture, and Education Sector Data Breaches: Schools at Risk for how government's cost trend compares to the public-adjacent education sector. A dedicated cloud misconfiguration breach post is planned for this cluster but not yet published on this site.
Where the Numbers Come From
- IBM Newsroom. (2026). "IBM Study: One in Four Malicious Breaches are AI-Enabled." Cost of a Data Breach Report 2026, published July 29, 2026, based on 602 breached organizations, March 2025 to February 2026.
- Industrial Cyber. (2025). "Comparitech reports 65% surge in ransomware attacks on government agencies in 2025." H1 2025 figures, citing Comparitech tracking.
- Comparitech. (2026). "Government Ransomware Roundup: H1 2026 stats on attacks, ransoms, and data breaches." H1 2026 attack counts, US share, and average ransom demand across 525 tracked attacks.
- Industrial Cyber. (2026). "Government ransomware attacks rose 13% globally to 187 incidents in first half of 2026."
- Keeper Security. (2026). "The Biggest Public Sector Data Breaches of 2026 So Far." Los Angeles City Attorney's Office breach, 7.7 terabytes, 337,000-plus files, March 2026.
Note: All figures verified as of September 2026. Government ransomware attack counts are compiled from public disclosures and claimed attacks and likely undercount total incidents, since Comparitech's own H1 2026 figures show only 89 of 187 tracked attacks were confirmed by the affected organization. This post's figures are refreshed at least twice a year to track new IBM and Comparitech report editions.
