Public Sector Incident Cost: City Ransomware, Federal Breaches, and Election Infrastructure in 2026
Public sector has the lowest average breach cost of the 17 industries in IBM's Cost of a Data Breach Report 2026, at $3.50M per breach (up from $2.86M in 2025). That average aggregates very different events. Disclosed municipal ransomware costs run from $217,000 (Knoxville, 2020) to an estimated $25M (Suffolk County, 2022), and federal-scale incidents such as OPM 2015 cost far more. The funding response (the 2021 State and Local Cybersecurity Grant Program, CIRCIA, the federal zero trust mandate) has reshaped public-sector security spending since 2022.
The Municipal Ransomware Benchmark Set
City and county ransomware events are unusually well documented because municipal spending is public and councils debate the response openly. Two patterns recur. Refusing the ransom has often cost far more than the demand (Baltimore refused about $76K and put its cost at $18.2M). Paying does not end the cost either, and it creates sanctions risk under OFAC guidance. The table lists only figures a city, county or contemporaneous official statement put on the record.
| Municipality | Year | Ransom | Total Cost |
|---|---|---|---|
| Atlanta, GA | Mar 2018 | ~$51K (BTC); not paid | No total published by the city |
| Baltimore, MD | May 2019 | ~$76K (BTC); refused | $18.2M incl. $8.2M lost revenue |
| New Orleans, LA | Dec 2019 | No demand received | $7.2M (about $3M insured) |
| Lake City, FL | Jun 2019 | 42 BTC (~$460K); paid by insurer; city paid $10,000 deductible | Total not published |
| Jackson County, GA | Mar 2019 | $400K; paid | Total not published |
| Knoxville, TN | Jun 2020 | 42.5 BTC (~$393K); not paid | $217,000 (city invoices) |
| Suffolk County, NY | Sep 2022 | $2.5M, cut to $650K; refused; no cyber insurance | Estimated $25M (county legislature report) |
| Oakland, CA | Feb 2023 | Not disclosed | Total not published; mayor proposed $10M more cyber spending |
| Dallas, TX | May 2023 | Not disclosed; no payment disclosed | $8.5M recovery budget |
| Columbus, OH | Jul 2024 | Not disclosed | $7M council request, after up to $4M emergency order |
Sources: Suffolk County Legislature special committee report (Sep 2024); City of Columbus council bulletin (2024); other rows from contemporaneous news reports quoting city officials or documents (Atlanta Journal-Constitution, GovTech, Smart Cities Dive, News4Jax, BankInfoSecurity, WATE, SecurityWeek, StateScoop). Figures are as each city stated them and are not comparable totals: some include lost revenue, some are budgets or estimates. Checked October 2026.
The OFAC Sanctions Issue
OFAC issued an advisory in October 2020, updated in September 2021, making clear that paying a ransom to a sanctioned person or group can violate sanctions law, chiefly the International Emergency Economic Powers Act. The IEEPA civil maximum is the greater of $377,700 per violation or twice the value of the transaction (inflation adjustment of January 2025). The advisory does not prohibit ransom payment outright, but liability is strict, so it requires sanctions due diligence before any payment.
For municipal entities the OFAC issue is acute because councils usually have to approve spending publicly, which forecloses paying quietly. The FBI and CISA both discourage ransom payment. CIRCIA (6 USC 681) will require covered entities to report ransom payments once its final rule takes effect; as of October 2026 the final rule had not been published.
Federal-Scale Incidents
Federal-agency incidents operate at a different cost magnitude entirely. The cost stack includes incident response, system replacement, mandated independent forensics (often via a CISA-coordinated firm), Congressional-hearing preparation cost, Inspector General reviews, and credit-monitoring services for affected federal employees that frequently extend to lifetime monitoring for security-clearance-holders.
| Incident | Year | Cumulative Cost | Notes |
|---|---|---|---|
| OPM (PII and SF-86 data) | 2014-2015 | $340M + up to $416M identity-protection contracts (reported) | About 22M federal employee and applicant records; mandated coverage ended FY2026 |
| SolarWinds (federal scope) | 2020 | No official federal cost published | Treasury, Commerce, State, DHS, Energy, Justice affected |
| Microsoft Storm-0558 (government email) | 2023 | No cost published | 22 enterprise organisations and 503 personal accounts affected (CSRB, March 2024) |
| MOVEit Transfer (federal scope) | 2023 | No aggregate cost published | Department of Energy and other agencies affected; Cl0p group |
| SEC EDGAR breach | 2016 (disclosed 2017) | No cost published | Test filings exfiltrated; insider-trading exposure |
The Funding Response
Public-sector security spending has been reshaped since 2021 by federal funding programs created in response to the municipal-ransomware wave and the federal-incident set. The most material programs:
- State and Local Cybersecurity Grant Program (SLCGP). $1B over four federal fiscal years (FY22-FY25) under the 2021 Infrastructure Investment and Jobs Act, administered by CISA and FEMA. Allocations to states by formula, with at least 80% required to flow to local entities.
- Tribal Cybersecurity Grant Program. About $18.2M across FY22 and FY23 combined (CISA).
- FEMA Homeland Security Grant Program. Cyber projects are eligible under SHSP and UASI.
- Federal Zero Trust Architecture mandate (OMB M-22-09). Applies to all federal civilian agencies.
- CISA Cybersecurity Performance Goals (CPG). Voluntary baseline used by underwriters and contracting officers as de-facto required.
The funding has not eliminated the municipal-incident cost premium. SLCGP grants are aimed mainly at baseline hygiene (MFA, asset inventory, endpoint coverage) rather than incident-response capability, so small towns and rural counties remain thinly resourced for a serious incident.
Costa Rica: National-Scale Incident Cost
The April 2022 Conti ransomware attack on the Government of Costa Rica is the clearest national-government-scale benchmark. Conti stole about 670 GB of data from 27 government institutions, including the Ministry of Finance, and President Rodrigo Chaves declared a national emergency. Tax collection, customs and import/export workflows were disrupted for weeks. Costa Rica's exporters estimated their losses at $38M a day while the systems were down (La Republica, April 2022), and the Minister of the Presidency reported about 13.4 billion colones of direct emergency spending to the Legislative Assembly in July 2022.
For planning purposes the lesson is the shape of the cost rather than its size: most of the economic damage fell on the private sector that depended on government systems, not on the government's own response budget.