I
What happened
CISA and state fusion centers continue to warn that local governments and special districts are routine ransomware targets. The pattern is consistent: a phishing mail, a reused password on a VPN, then encryption of file shares that hold utility billing and public-works maps. 911 itself is often on a separate stack, but the adjacent records that dispatchers need are not. Wisconsin’s many villages and school districts match the target profile: small IT staff, lots of vendors, old servers.
II
Timeline
- 2018–presentA long run of city and school ransomware cases nationwide.
- StandingCISA publishes free playbooks for local government.
- This editionTreat identity and backups as public-safety gear.
III
Why it happened
Shared generic accounts survive because they are convenient on a Friday. Backups sit on the same network they are meant to outlive. Vendor remote access is left open ‘until the project is done,’ which is never. The root cause is capacity, not ignorance of the threat.
IV
What can be learned
Offline, tested backups beat a new firewall brochure. Multi-factor authentication on email and VPN is the cheapest control that actually changes the outcome. A paper runbook for the first four hours of an incident is worth more than a binder of unused policy.
V
Risks
Utility billing downtime, delayed payroll, leaked resident data, and diverted public-safety attention. Copycat phishing follows any public breach notice.
VI
Opportunities
Shared municipal SOC services, tabletop drills, and a standing market for people who can do boring identity hygiene. Local MSPs who will say no to shared passwords are scarce and valuable.
VII
Safety review
High — cyber / public
Cyber · Public safety
- MFA on every email and VPN account. No shared logins.
- One offline backup restore test per quarter, timed with a stopwatch.
- A one-page incident card: who calls CISA, who calls the insurer, who talks to residents.
VIII
Associated jobs
- Municipal systems administrator. Towns will pay for someone who can lock down identity.
- Cybersecurity analyst. State and county fusion-adjacent roles keep opening.
IX
Sources
- CISA ransomware guidance — CISA
- MS-ISAC resources — CIS