When the Town Hall Goes Dark.

In March 2018, people in Atlanta lost the ability to pay utility bills online or over the phone, and the municipal court couldn't schedule hearings for nearly a month. The ransomware was SamSam. That November, federal prosecutors in New Jersey charged two Iranian men over SamSam attacks on more than 200 victims that allegedly brought in about $6 million and caused more than $30 million in losses. Months before the attack, an audit presented to city leaders had flagged thousands of vulnerabilities.

A year later it was Baltimore. RobbinHood ransomware hit the city's network on 7 May 2019, the attackers asked for the equivalent of $76,000 in bitcoin, and the city's budget office estimated the attack would cost at least $18.2 million.

In July 2021 the district of Anhalt-Bitterfeld in Saxony-Anhalt declared a disaster on 9 July after attackers encrypted its data. Residents could reach the district only by phone or fax. The head of the German Association of Towns and Municipalities called it the first case in which a disaster had been declared so that the administration could keep working.

In October 2020, attackers encrypted 440,000 files at the London Borough of Hackney, affecting at least 280,000 residents. When the UK data protection regulator reprimanded the council in July 2024, the failures it named were ordinary ones: a patch management system that wasn't actively applied to all devices, and an insecure password on a dormant account still connected to council servers. The ICO's deputy commissioner called it "a clear and avoidable error".

How the attackers got in varies from case to case. What separates the outcomes is how long the dark lasted, and that depends less on how the attackers got in than on what the victim finds when it tries to start again.

The British Library's own review of its October 2023 attack is the clearest account we know of that second problem. The Rhysida gang copied some 600GB of files and encrypted or destroyed substantial portions of the server estate. The Library's conclusion is blunt: "our reliance on legacy infrastructure is the primary contributor to the length of time that the Library will require to recover from the attack." Some systems, including its main library services platform, "cannot be brought back in their pre-attack form, either because they are no longer supported by the vendor or because they will not function on the new secure infrastructure." Others would need to be migrated, modified, or "rebuilt from the ground up," because they were unsupported and "cannot be repurchased or restored." The backups were not the bottleneck. The software was.

Then there is the case that shows how far one intrusion can spread. On the night of 29 to 30 October 2023, attackers hit Südwestfalen-IT, a municipal IT provider in North Rhine-Westphalia. According to the state government's answer to a parliamentary question, the attack forced an immediate shutdown of all its systems and hit the 72 member municipalities, with more than 100 municipalities in the state affected in total. About nine months later, several of them could finally announce they were back online.

The numbers say this isn't rare. In Sophos's survey of state and local government IT leaders, 34% were hit by ransomware in the past year, 99% of those hit said attackers tried to compromise their backups, and 51% of those attempts succeeded. The mean recovery cost was $2.83 million. In Europe, ENISA's 2026 threat landscape again ranks public administration as the most targeted sector, at 32% of cases. Much of that is low-impact DDoS, but ENISA still calls ransomware "the most short-term impactful type of incident", and it framed this year's edition around how dependencies weaken digital resilience.

Ransomware in state and local government, 2024

mean cost to recover

$2.83M

mean cost to recover

• Organisations hit by ransomware in the past year 34%
• Of those hit, attackers tried to compromise backups 99%
• Of those attempts, the backup compromise succeeded 51%

Here is where we have to be careful. Open source does not prevent ransomware. Hackney fell to an unpatched estate and a forgotten password. Südwestfalen-IT's attackers got past its VPN. Open-source software gets left unpatched too, and an abandoned open-source application is just as much legacy as an abandoned proprietary one. Anyone who says switching licences stops attacks is selling something.

What the cases do point to is what speeds recovery. CISA's #StopRansomware Guide reads like a list of things the British Library couldn't do: take inventory of your IT assets, maintain "golden images" of critical systems, keep infrastructure as code under version control, and "rebuild systems based on prioritization of critical services." All of that assumes you know what you run and can get it again.

That is where openness earns its place. Software whose source and old versions are public can't be withdrawn from the market the way the Library's platform effectively was. A system built on open standards and documented formats can be restored onto new infrastructure by someone other than the original vendor. A self-hostable stack lets a council rebuild on its own schedule instead of waiting in a supplier's incident queue alongside every other customer hit that week. And code that's published can be read, fixed, and reused by the next council. Hackney, for one, publishes hundreds of repositories on GitHub. None of that stops the break-in. All of it shortens the dark.

Shared infrastructure cuts both ways, and Südwestfalen-IT is the warning. Pooling IT across 72 municipalities makes sense: small towns can't each hire a security team. It also means one intrusion can take all 72 offline at once. The alternative isn't every town for itself. It's sharing knowledge and fixes widely while keeping failure domains small. The Dutch municipalities' association runs an information security service that supports all Dutch municipalities and facilitates knowledge sharing among them, without running their systems for them.

Small public bodies also have more free help than they may know. CISA's vulnerability scanning for internet-facing systems is available at no cost to state and local governments. In the UK, the NCSC's Protective DNS is free and centrally funded, and it protects over 1,400 organisations including local government. That help is a policy choice, and policy changes: federal funding for the MS-ISAC, which serves about 18,000 US government organisations, ended in September 2025, and it moved to a paid membership model.