White Paper
The Rising Public Sector Cyber Threat
White Paper Summary

Hannah Hays, Senior Underwriter, Public Entity & Cyber at Munich Re Specialty, emphasizes that with higher attack frequency and rising recovery costs, public entities should seriously consider comprehensive cyber coverage.
Government entities have become prime targets for cybercriminals due to their management of critical infrastructure and vast repositories of personal and financial data. Munich Re’s 2025 cyber report, Cyber Insurance Risks and Trends 2025 revealed that government, manufacturing, and technology sectors are particularly susceptible to cyberattacks, with public entities facing ransomware attacks, phishing scams, and data breaches involving sensitive citizen information.
The threat landscape for public entities extends beyond direct attacks to include supply chain vulnerabilities that can trigger massive disruptions. The 2024 CrowdStrike outage, caused by a faulty security update, created one of the largest IT outages in history and highlighted how third-party incidents can cripple public operations. These supply chain risks can be covered by cyber insurance but present unique underwriting challenges.
Educational institutions within the public sector face particularly severe exposures, as demonstrated by the PowerSchools data breach in December 2024. This incident compromised approximately 62 million students’ personal information, leading to an ongoing extortion attempt with a $2.85 million ransom paid to a 19-year-old attacker, with no guarantee that the compromised data would be deleted.
“We’re observing new ways these organizations are being attacked, even through their suppliers,” Hays explains. “With increasing digitalization, public entities face more frequent and severe cyber events, which is why they should seriously consider purchasing cyber insurance.”
The sophistication of attacks continues to evolve, with cybercriminals employing double encryption tactics where they encrypt data and then release it publicly. Organizations must then address recovery costs to restore data and networks while mitigating business interruption, expenses typically covered under cyber policies.
To learn more about Munich Re, please visit their website.

