Top 10 cybersecurity risks and threats in the public sector in 2025 

The public sector was one of the highly targeted sectors in 2024. It is mainly because the public sector is a goldmine of sensitive data like names, addresses, contact numbers, email addresses and social security numbers.  

The public sector is mainly targeted by cybercriminals because of political motive, as a protest, or for a social cause. For example, an attacker may engage in the alteration of websites and engage in the orchestration of attacks like denial-of-service attacks, data breaches, website mirroring, and geobombing. 

Since public sector organizations are responsible for providing critical infrastructure facilities, state-sponsored attacks often target public sector organizations to cause massive disruptions in operations. Any disruption in critical infrastructure facilities can cause chaos and, in some cases, cause civil unrest. 

What are some of the most alarming cyber-attacks on the public sector? 

The following are some of the most shocking cyber attacks on the public sector in 2024:

• Ransomware attacks targeted multiple counties of the U.S in the first half of 2024 causing massive disruption in the essential public services 
• The city of Columbus was affected by a ransomware attack, in November 2024, affecting more than 500000 citizens and city employees 
• The US Environmental protection agency suffered a data breach in April 2024 that caused a compromise of records of more than 8500000 

Some facts worth considering

Source: Verizon Data Breach Investigation Report 2024 

• 59% cyber attacks in the public sector were caused by internal actors  
• 41% cyber attacks in the public sector were caused by external actors 
• 78% of data breaches in public sector were orchestrated using Social Engineering, System Intrusion, and due to miscellaneous errors.  
• 71% of attacks were carried out with a motive of financial gain 
• 29% of attacks were carried out with a  motive of espionage 

Why are public sector organizations the most targeted compared to any other sector? 

Some key factors make public sector organizations one of the primary targets of cyber criminals: 

Public sector organizations have a pool of information assets with entrusted citizen data.

These comprise personal information such as names, addresses, social security numbers, login credentials, and phone numbers. Cybercriminals exploit this stolen information to engage in tailored phishing campaigns or sell them in the dark web market.   

An understaffed team and a limited budget for security 

Public sector organizations often struggle with having an understaffed team for cybersecurity that can help them identify and implement measures for security that encompass some of the best practices of the industry that defend them from modern-day threats. Additionally, they lack the budget needed for cybersecurity.  

Geopolitics

One of the primary reasons why public sector organizations become a target is because of geopolitical instability.  It often results in countries targeting their critical infrastructure organizations that may be public sector-based (for most countries) for recon or to disrupt operations.

Technology used in the public sector is highly outdated 

Public sector organizations often contain infrastructure that is highly outdated in nature. A lot of the systems are vintage in nature with long unchecked vulnerabilities that are documented and easily accessible by cyber attackers to exploit. Since a lot of these systems are interconnected in nature, it is easier for them to take over the infrastructure and bypass their security.  

The top 10 cybersecurity risks in the public sector 2025

Let us discover some of the most dangerous cybersecurity risks to the public sector in 2025: 

1. APT and State-sponsored attacks aimed at critical infrastructure  

Geopolitics has caused nations to war on the digital front, comprising some of the most sophisticated attackers. These attackers spend more time studying their target, deploying advanced techniques to infiltrate and remain undetected in the network. 

Once they have infiltrated the network, they engage in reconnaissance, collecting all the information they can about the cybersecurity setup, the security measures/controls in place, etc. They would continue their persistence by staying undetected in the system, relaying back information, and creating exit points in their target’s defense. 

These attackers usually target all the critical infrastructure organizations that provide essential services such as energy, food and agriculture, information technology, and water and wastewater systems. 

2025 is going to witness a significant rise in such state-sponsored attacks. 

2. Ransomware attacks

2025 will witness a rise in ransomware attacks that leveraged social engineering to inject malware into the system and orchestrated complex attacks that encrypted information in exchange for a ransom. Public organizations will always be under threat of ransomware attacks because of the abundance of information assets. 

3. Phishing attacks

Around 60% reporting shortage in staff for cybersecurity (ISC2,WFS,2024) in 2024. The public sector is no stranger to this. There is a persistent problem of understaffing and lack of cybersecurity awareness in the public sector, making it challenging to identify and implement those best practices for security against the most modern threats.   

Cybercriminals will take advantage of this fact to orchestrate advanced social engineering-based attacks that will aim at baiting their victims based on information that seems more believable and genuine. 2025 will see a rise in phishing attacks and cyber criminals with more seemingly believable campaigns. 

4. State elections and political events

Cybersecurity experts have found instances of cybercriminals trying to disrupt events of national importance like elections. These threat actors would target voting equipment software, exploits vulnerabilities and alter the data. They would target remote voting mechanisms that store poling related data. Cybersecurity experts in 2025 must proactively assess these machines that are used for voting, identify security vulnerabilities in them, keep software patched regularly and take measures to fill gaps in their security.  

5. DDoS attacks  

Cybercriminals would use Distributed Denial of Service (DDoS) attacks to cause massive disruption in operations. Since most of the systems that are deployed in the infrastructure are interconnected, the compromise of one system can cascade to the compromise of others.  This rapid adoption of wireless technology and cloud environments in government organizations has made them more exposed to cyber criminals who are equipped with advanced tools to bypass simpler security mechanisms.  Securing operations through round-the-clock security and support and incident response with proactive setup of backup and recovery will have to be a top priority for organizations in 2025. 

6. Hacktivism attacks  

Cybersecurity expert have observed a significant rise in hacktivism activity in 2024 with groups targeting government organizations for causes like environmental degradation, social causes etc.   Some of the common techniques and tactics used by attackers include using denial of service attacks to disrupt existing websites and services, engaging in website defacement and replacing the content with their message, and using social media to spread their message across the internet. Many experts believe that despite the reduction in hacktivism activities worldwide, it will quickly rise again in 2025 due to the increasing geographical and environmental chaos.    

7. Generative AI based attacks 

In 2025, there will be an increased proliferation of artificial intelligence and machine learning in public sector organization, as cyber attackers have already begun integrating advanced AI-based malicious tools to orchestrate cyberattacks in 2024.   

For example, an AI-based chatbot tool “Fraud GPT” has gained quite a popularity among cyber criminals with its ability to provide AI-based assistance in crafting malicious tools and full-fledged phishing campaigns.  They engage in stealing, reverse engineering, and manipulation of machine learning models to come up with malicious undetectable covert malware that may engage in stealing the most sensitive data of public organizations. They may poison the data fed to the machine-learning model, causing it to malfunction.    

Public sector organizations will move past their previous approach, prioritize cybersecurity, and implement measures for automated AI/ML-based threat detection and response.  

8. Insider threats 

Since employees have a good deal of access permissions and some idea of the cybersecurity setup of their organizations, insiders become some of the most unforeseen sources of attacks. By being an insider, an attacker already has a great deal of access to all the sensitive information that they can exploit, such as personal information, company-specific information, and access credentials. Due to the increased adoption of cloud, it has become more challenging for organizations to detect insider threats. There is also an increased risk of human error since most organizations do not prioritize programs for raising awareness of some of the best practices for cybersecurity. A cybercriminal may exploit the security vulnerabilities created due to human error. In 2025, public organizations will have to prepare themselves against insider threats, with threat actors utilizing their permissions and access to relay some of the most critical information about the company. 

9. Increased cybersecurity skills gap 

The global cybersecurity skills gap is predicted to rise at 19.1% on a YoY basis (ISC2,2024). There will be a global cybersecurity talent shortage in 2025 as public organizations foray into digital realms to meet new levels of operational efficiency and cater to the welfare of citizens. As the shortage continues to grow, the cost of hiring will increase over time making it more challenging for public sector organizations to hire and retain talent for cybersecurity.     

It is because private organizations would have more budget for cybersecurity, hence, they would be able to hire cybersecurity talent better compared to the public sector. Therefore, in 2025, organizations will need to prioritize their cybersecurity and increase the budget for cybersecurity to retain talent. It would also mean raising awareness within the organization regarding some of the best security practices to mitigate the risks that arise due to security gaps.  

10. Supply chain attacks 

Public sector organizations rely on external contractors for rendering some services. When these contractors use software with security vulnerabilities, it can put the entire organization at cybersecurity risk. In 2025, there will be increased sophistication of techniques. Cybercriminals will target all the weakest points in the software deployed by external contractors. Hence, they must consider assessing their agreements for periodical security assessments. They must include a security review of all the software used by contractors and assess them for security best practices that are implemented by them.