Why small municipalities have become cybercriminals' favorite prey

The call came at 6:47 a.m. on a Tuesday. The public works director couldn't log in. Neither could anyone in finance. By the time the city manager arrived, the message on every screen was clear: the city's entire network was encrypted, and the attackers wanted $350,000 in Bitcoin.

This wasn't a major metropolitan area with a dedicated cybersecurity team. It was a community of 12,000 people with an IT department of one. The city had no incident response plan, no cyber insurance and backups that hadn't been tested in over a year.

Stories like this play out thousands of times each year across America's small municipalities. While headlines focus on attacks against major cities and Fortune 500 companies, criminal organizations have quietly discovered that small local governments offer something even better: essential services under political pressure to pay, defended by IT teams stretched impossibly thin.

The Math That Works Against Us

The United States has roughly 35,000 local governments. The vast majority serve populations under 50,000, and most have IT departments of one to three people, if they have dedicated IT staff at all.

Ransomware operators have done the math. Attacking a large enterprise means facing security operations centers and incident response teams. Attacking a small municipality means facing a single IT generalist who spent the morning fixing a printer jam.

The pressure dynamics favor attackers too. When a municipality gets hit, residents lose access to essential services: water billing systems go dark, permit applications stall, court records become inaccessible. The calculus shifts toward paying, simply to make the crisis stop

Anatomy of an Incident

Initial access usually comes through one of three doors: a phishing email that tricks an employee into revealing credentials, a compromised vendor connection, or an exposed system that hasn't received recent security updates.

Once inside, attackers spend days or weeks exploring the network, identifying valuable systems, locating backups and escalating their privileges. In flat networks with limited monitoring, this activity goes undetected. By the time the ransomware detonates, attackers have already positioned themselves to cause maximum damage.

The decision of whether to pay is agonizing. Paying rewards criminal behavior and offers no guarantee of recovery. But not paying means potentially months of recovery work and costs that often exceed the ransom amount many times over. There's no good option, only less-bad ones.

A Realistic Defensive Framework

Enterprise security advice typically assumes resources that small municipalities don't have. A more realistic approach is what I call the "pick three" framework: focus intensively on three priorities that deliver the highest return for limited investment.

Priority One: Multi-Factor Authentication Everywhere You Can

Multi-factor authentication requires users to prove their identity with something beyond a password, typically a code from a phone app. This single measure defeats the vast majority of credential-based attacks.

Start with email and remote access systems. Most cloud email providers include MFA at no additional cost; it just needs to be enabled. Expect resistance from staff who find it inconvenient. Frame it as non-negotiable, like wearing seatbelts.

Priority Two: Backups That Actually Work

Many municipalities believe they have functioning backups until an incident reveals otherwise. Common failures include backups that haven't run successfully in months, backup systems connected to the same network as production systems (and therefore encrypted alongside them), and backups that no one has ever tested restoring from.

Effective backup strategy requires regular testing, isolation from the primary network, and sufficient retention to recover from attacks that went undetected for weeks. Schedule quarterly restoration tests and treat failures as urgent issues.

Priority Three: One Relationship Before the Crisis

When an incident occurs, having an established relationship with someone who can help is invaluable. That might be with the Multi-State Information Sharing and Analysis Center, a state-level cybersecurity office, or an incident response firm.

MS-ISAC deserves particular mention because its services are free to local governments and include 24/7 incident response support. If your municipality isn't already a member, joining should be this week's task.

The Manager's Role

City and county managers often assume cybersecurity is a technical problem that should be delegated to IT. This assumption is dangerous. Cybersecurity is fundamentally a risk management challenge requiring executive attention that only managers can provide.

IT staff can identify what needs to be done. They cannot, on their own, compel behavioral changes from other departments, allocate budget, or set policy about acceptable risk levels. 

Practical steps managers can take include adding cybersecurity as a regular agenda item, requiring annual briefings on security posture, including security requirements in vendor contracts, and establishing clear incident response authority before an incident occurs.

Looking Ahead

The threat environment for small municipalities will likely worsen before it improves. But individual municipalities can significantly improve their odds. The "pick three" framework addresses the gaps that attackers most commonly exploit. None requires massive budgets or specialized expertise. All require sustained attention and organizational will.

The municipality that received the ransom demand at 6:47 a.m. eventually recovered without paying. 

It took eleven weeks and cost far more than the ransom in overtime, consulting fees, and degraded services. The manager who led that recovery always emphasizes the same point: everything they did after the attack would have been easier, faster, and cheaper if they had done a few things differently before it.

Alton Henley is Dean of Business and Hospitality at Montgomery College with expertise in digital transformation for small municipalities. He serves on the advisory board of KC7, a nonprofit providing free cybersecurity training. Contact: alton.henley@montgomerycollege.edu