Most relevant cybersecurity incidents in the public sector

This breach, discovered in December 2024 and reported in January 2025, affected over 71.9 million victims across U.S. school systems. It highlights the significant impact of vendor-driven incidents on public-sector education systems.

Attributed to Chinese state-sponsored actors, Salt Typhoon involves ongoing campaigns to plant spyware and steal data from critical infrastructure. These attacks represent a major shift in cyber geopolitics, forcing public declarations of national defense crises.

This major attack in August 2025 disrupted statewide services, including DMV operations and law enforcement dispatch systems. It demonstrates the broad impact cyberattacks can have on essential state-level public services.

The City of St. Paul declared a state of emergency after a ransomware attack disabled key municipal systems. This incident highlights chronic underinvestment in local government IT infrastructure and the need for external assistance.

This ongoing campaign, reported in February 2026, involved hackers working for an Asian government breaching at least 70 government agencies and critical infrastructure organizations in 37 countries. It demonstrates a persistent, sophisticated threat to global public sectors.

Hackers exploited critical Ivanti zero-day vulnerabilities to gain unauthorized access to systems used by European and Dutch government bodies. This incident raises concerns about sensitive institutional data exposure and the ongoing risk of zero-day exploits.