Government Cyberattack Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen, Cybersecurity | Last updated: September 4, 2026 | License: CC BY 4.0
The last government-wide count of United States federal cybersecurity incidents covers a fiscal year that ended on September 30, 2023. It reported 32,211 incidents. Thirty-five months later, no successor figure has been published. Every “government cyberattack statistic” circulating in 2026 that cites a federal number is citing that one.
Quick Answer
Axis Intelligence Research finds the most recent published United States government-wide federal incident total is 32,211 incidents for fiscal year 2023, a figure now 35.1 months old, with no fiscal 2024 or fiscal 2025 equivalent released. Over the same window, the European Union recorded 586 publicly reported incidents against public administration in 2024 and the United Kingdom handled 204 nationally significant incidents through August 2025 — both current within the past two years. Axis Intelligence Research’s Government Cyber Disclosure Index (GCDI™) scores US federal disclosure at 30.0 of 100, against 81.6 for the EU and 82.35 for the UK.
Key Findings
- Axis Intelligence Research finds the United States has not published a government-wide federal cybersecurity incident count since the fiscal 2023 figure of 32,211, released by the Office of Management and Budget in June 2024 — a 27-month publication gap in a report that statute requires annually.
- Axis Intelligence Research calculates a Federal Breach Escalation Rate of 43.6% for fiscal 2023: federal agencies recorded 19,700 breaches internally but escalated only 8,587 to CISA, leaving 11,113 breaches visible to the agency that suffered them and to nobody else.
- According to the FBI’s 2025 Internet Crime Report, losses to government impersonation fraud reached $797,943,193 in 2025 — Axis Intelligence Research calculates a 96.7% increase over 2024, against 2.9% growth the year before.
- According to ENISA’s November 2025 sectorial threat landscape, 69% of publicly reported EU public administration incidents in 2024 struck central government, 24% local entities and 6.8% regional bodies — the only published subsector split of its kind in any jurisdiction.
- According to the NCSC’s Annual Review 2025, the United Kingdom handled 204 nationally significant cyber incidents in the year to August 2025, up from 89 — a 129.2% rise that Axis Intelligence Research resolves to 3.91 such incidents per week.
Why Government Cyberattack Statistics Are Harder to Find Than Any Other Sector
Almost every sector has a census. Healthcare has the HHS breach portal. Publicly traded companies have 8-K disclosure. Critical infrastructure has FBI complaint data. Government — the sector that mandates everybody else’s reporting — has the weakest public record of its own.
That is not a rhetorical flourish. It is a documented gap, and it is the reason this page exists.
The Federal Information Security Modernization Act of 2014 requires the Office of Management and Budget to submit an annual report to Congress summarising the effectiveness of federal information security and the incidents recorded during the preceding year. The CIO Council’s own handbook describes it as an annual publication. The most recent one available to the public is the FY 2023 Annual Report, published in June 2024.
Agency-level work continued. Inspectors general filed fiscal 2025 FISMA audits; those documents are public. What stopped was the aggregation — the single table that says how many incidents the federal government reported, broken down by attack vector and severity. Without it, there is no defensible answer to “how many cyberattacks does the US government experience per year” for any period after September 2023.
Marcus Chen: Ask a SOC lead what the worst possible outcome of a detection programme is, and nobody says “too many alerts.” They say “we stopped counting.” A number that goes stale is a measurable thing — you can date it and reason about it. A number that is never published removes the denominator from every ratio anyone might build. That is the state of US federal incident data right now, and it is why so much government cyberattack reporting in 2026 quietly recycles a fiscal 2023 table without saying so.
How Many Cyberattacks Does the US Federal Government Report Each Year?
Federal agencies reported 32,211 information security incidents to CISA in fiscal 2023, up 9.9% from 29,319 in fiscal 2022. Agencies attributed the rise mainly to better detection at security operations centres rather than to more attacks.
The vector breakdown is where the operational story lives.
| Attack vector | FY2023 incidents | Share | Source |
|---|---|---|---|
| Improper usage | 12,261 | 38.1% | OMB FISMA FY2023 |
| Email / phishing | 6,198 | 19.2% | OMB FISMA FY2023 |
| Other / unknown | 5,687 | 17.7% | OMB FISMA FY2023 |
| Web | 3,569 | 11.1% | OMB FISMA FY2023 |
| Loss or theft of equipment | 3,135 | 9.7% | OMB FISMA FY2023 |
| Attrition (brute force) | 1,147 | 3.6% | OMB FISMA FY2023 |
| External / removable media | 92 | 0.3% | OMB FISMA FY2023 |
| Multiple attack vectors | 92 | 0.3% | OMB FISMA FY2023 |
| Impersonation / spoofing | 30 | 0.1% | OMB FISMA FY2023 |
| Total | 32,211 | 100% | OMB FISMA FY2023 |
Shares calculated by Axis Intelligence Research; components sum exactly to the published total.
Two movements inside that table matter more than the headline. Phishing incidents rose from 3,011 to 6,198 — a 105.8% increase in a single year. And “other/unknown” fell 49.0%, from 11,144 to 5,687. Read together, those are not contradictory: agencies got better at classifying what was already happening, and a large share of what had been unattributed turned out to be email.
How Severe Were Federal Incidents?
Roughly 99% of fiscal 2023 incidents were rated “baseline” under the National Cyber Incident Scoring System, meaning highly unlikely to affect public health, national security or economic security. Thirty-one incidents reached “medium.” None reached high, severe or emergency. Eleven met the statutory threshold for a major incident.
Those eleven are the ones with names attached. A ransomware attack on a contractor system supporting the Centers for Medicare and Medicaid Services exposed data on approximately 2.8 million individuals. A zero-day in a file transfer product used by an Office of Personnel Management contractor exposed survey records for roughly 632,000 federal employees at the Departments of Justice and Defense.
The pattern in nine of the eleven is the same one that governs open source and third-party vulnerability exposure everywhere else: the compromise happened at a contractor, a vendor, or a shared service, not on the agency’s own network.
Marcus Chen: The severity distribution is doing more work than most readers notice. Ninety-nine percent baseline is not a claim that federal networks are quiet — it is a claim about what a scoring system was designed to escalate. Eleven major incidents out of 32,211 means the threshold is high, which is defensible. It also means the number people quote as “federal cyberattacks per year” is overwhelmingly composed of policy violations and blocked phishing, while the incidents that actually matter are a set small enough to list by hand.
The Federal Breach Escalation Rate: What Agencies Record vs What CISA Sees
Buried in the privacy section of the fiscal 2023 report are two numbers that are almost never read together. Agencies were asked how many breaches were reported within the agency, and separately how many were reported to CISA.
| Agency group | Breaches recorded internally | Breaches escalated to CISA | Escalation rate |
|---|---|---|---|
| CFO Act agencies | 18,909 | 8,420 | 44.5% |
| Non-CFO Act agencies | 791 | 167 | 21.1% |
| All reporting agencies | 19,700 | 8,587 | 43.6% |
Source: OMB FISMA Annual Report FY2023, Table 16. Rates calculated by Axis Intelligence Research.
Axis Intelligence Research finds a Federal Breach Escalation Rate of 43.6% for fiscal 2023. In plain terms: 11,113 breaches were logged inside federal agencies and never surfaced to the central coordinating body.
This is not evidence of concealment. A “breach” under OMB Memorandum M-17-12 is a broad category, and the great majority of the unescalated events are almost certainly minor mishandlings of personal information that never met a reporting threshold. The finding is about visibility, not misconduct: the number CISA holds is under half the number agencies hold, and the smaller agencies — the ones with the thinnest security staffing — escalate at less than half the rate of the largest.
Nobody else appears to publish this ratio. It is derived from two figures in the same table that the report itself never compares.
Government Cyber Disclosure Index (GCDI™)
Proprietary metric — first published by Axis Intelligence Research, September 2026.
The GCDI™ measures how much of a jurisdiction’s government cyber incident reality is actually visible to the public, on a 0–100 scale where higher means more visible. It exists because “which government is attacked most?” is unanswerable in the current data, while “which government tells you what happens to it?” is answerable and turns out to explain most of the apparent differences.
Components and weights
| Component | Weight | What it measures |
|---|---|---|
| Reporting currency | 30% | Age of the most recent published government-wide incident dataset, measured from the end of its reporting period |
| Breakdown granularity | 25% | Whether the publisher discloses attack vector, severity tier, subsector and time series (25 points each) |
| Incident-count disclosure | 25% | Whether a government-wide incident count exists at all for the most recent completed period |
| Adversary attribution | 20% | Whether named threat actors or intrusion sets are disclosed with quantified shares |
Currency sub-score = max(0, min(100, 100 − (months_since_period_end − 12) × 5)). A dataset published within twelve months of its period close scores 100; each additional month costs five points.
Baseline readings, as of September 4, 2026
| Jurisdiction | Currency | Granularity | Count disclosure | Attribution | GCDI™ |
|---|---|---|---|---|---|
| United States (federal) | 0.0 | 100 | 0 | 25 | 30.0 |
| European Union | 59.5 | 75 | 100 | 100 | 81.6 |
| United Kingdom | 99.5 | 50 | 100 | 75 | 82.35 |
Worked arithmetic. United States: (0.30 × 0) + (0.25 × 100) + (0.25 × 0) + (0.20 × 25) = 30.0. European Union: (0.30 × 59.5) + (0.25 × 75) + (0.25 × 100) + (0.20 × 100) = 81.6. United Kingdom: (0.30 × 99.5) + (0.25 × 50) + (0.25 × 100) + (0.20 × 75) = 82.35. All three verified in exact rational arithmetic.
Input derivation. US currency: the fiscal 2023 reporting period closed 2023-09-30; 35.1 months elapsed, which drives the sub-score to zero. EU: ENISA’s public administration period closed 2024-12-31, 20.1 months elapsed → 59.5. UK: the NCSC period closed 2025-08-31, 12.1 months elapsed → 99.5. Granularity scores count published dimensions: the US report discloses all four (vector, NCISS severity, per-agency, multi-year) and scores 100; ENISA discloses threat type, subsector and time series but no per-incident severity scale, scoring 75; the NCSC discloses severity categories and a four-year trend but neither vector nor sector breakdown, scoring 50. Count disclosure is binary. Attribution: ENISA names intrusion sets with percentage shares (100); the NCSC names states and three specific CVEs without quantified shares (75); the FY2023 US report describes “an advanced persistent threat nation state sponsored actor” without naming it (25).
What the readings mean
The United States publishes the best-structured government cyber incident data of the three and the least current. Granularity of 100 against currency of 0 is not a paradox — it is the signature of a strong reporting instrument that stopped firing. The EU and UK arrive at nearly identical composites by opposite routes: ENISA trades timeliness for depth, the NCSC trades depth for timeliness.
What the GCDI™ does not capture. It scores disclosure, not defence. A jurisdiction can publish nothing and be well defended, or publish everything and be compromised weekly. It also weights only government-wide datasets: agency-level inspector general audits, which the US continues to publish, are outside scope by design, because they cannot be summed into a national figure. And a jurisdiction can raise its score by publishing more without changing a single control.
Reading trigger. The GCDI™ re-reads on publication of any new government-wide incident dataset by OMB, ENISA or the NCSC, and on any change to the weights, which will be disclosed and re-baselined rather than applied retroactively.
Which Sector Do Government Attackers Actually Target in Europe?
ENISA’s sectorial threat landscape for public administration, published November 2025, is the closest thing any jurisdiction has to a purpose-built government cyberattack dataset. It analysed 586 publicly reported incidents against EU public administration across calendar 2024 — an average of 21.7 per Member State.
| Subsector | Share of incidents | Dominant threat | Source |
|---|---|---|---|
| Central government | 69% | DDoS against ministry and parliament websites | ENISA, Nov 2025 |
| Local entities | 24% | Intrusion (58% of local incidents) | ENISA, Nov 2025 |
| Regional entities | 6.8% | DDoS (over 60% of regional incidents) | ENISA, Nov 2025 |
That inversion is the most operationally useful finding in the dataset and it is not in any headline. Central government absorbs the volume, and the volume is noise: short-lived floods against public-facing portals. Local government absorbs a quarter of the incidents, and the majority of those are actual intrusions — credential compromise, malware, data theft. Municipalities alone accounted for almost 44% of local incidents.
| Threat type | Share of EU public administration incidents | Source |
|---|---|---|
| DDoS | ~64% | ENISA, Nov 2025 |
| Data breach | 17.4% | ENISA, Nov 2025 |
| Ransomware | ~10% | ENISA, Nov 2025 |
| Data exposure | 1% | ENISA, Nov 2025 |
Across the full ENISA Threat Landscape 2025, which analysed 4,875 incidents between July 2024 and June 2025, public administration was the most targeted EU sector at 38.2% — implying roughly 1,862 incidents by Axis Intelligence Research’s calculation.
Who Is Attacking European Government Networks?
Hacktivists accounted for nearly 65% of incidents. Cybercrime operators took approximately 16%. State-nexus intrusion sets accounted for 1.2%. Roughly 17% could not be confidently attributed.
A disclosed discrepancy. ENISA’s Figure 10 gives state-nexus activity as 1.2% of incidents; its own executive summary and Section 4.1 both give 2.5%. Both figures appear in the same document, describing the same dataset. Axis Intelligence Research carries the Figure 10 value as the primary reading because it is the one presented alongside the full adversary breakdown that sums with the other categories, and records 2.5% as an alternative published value rather than reconciling the two silently. Journalists citing either number should cite the section it came from.
A single group, the pro-Russia set NoName057(16), claimed 46% of all DDoS attacks against EU public administration. Its campaign timing tracked geopolitics with unusual precision: attack volume peaked in July and December 2024, aligned with EU defence commitments to Ukraine and with the arrests of three suspected DDoSIA platform operators in Spain.
On the criminal side, RansomHub accounted for 20.7% of ransomware incidents against the sector in its first year of operation. Initial-access brokers advertised VPN and RDP access into government networks — including the Polish Government Communications Centre and the French Ministry of Defence intranet — at $7,000 to $15,000 per listing. That price is the clearest available market signal on what credential-based access to a government network is worth to the people buying it.
Marcus Chen: Two-thirds hacktivist DDoS is a statistic that will get misread all year. It does not mean European governments are mostly attacked by teenagers with booters. It means the countable incidents are mostly that, because a Telegram channel posts a screenshot and a journalist writes it up, while a state-nexus implant in a ministry mail server surfaces years later or never. ENISA says as much: initial access vectors were “largely not available in the open sources.” The 1.2% is a floor on espionage, not an estimate of it.
The compounding risk is the shared service. The Akira compromise of the Nordic outsourcer Tietoevry in January 2024 hit payroll and case-management platforms used by approximately 120 Swedish government agencies and municipalities from a single point of entry — the same third-party dependency pattern that dominates insider and trusted-access exposure across the public sector.
What Do Government Cyberattacks Actually Cost Citizens?
Individual-level impact is where government breaches diverge sharply from corporate ones. Citizens cannot switch providers.
| Incident | Individuals or entities affected | Year | Source |
|---|---|---|---|
| France Travail (employment service) | 43,000,000 | 2024 | ENISA, Nov 2025 |
| CMS contractor ransomware (US) | 2,800,000 | 2023 | OMB FISMA FY2023 |
| OPM contractor file-transfer zero-day (US) | 632,000 | 2023 | OMB FISMA FY2023 |
| Eindhoven municipality BSN exposure | 220,000 | 2024 | ENISA, Nov 2025 |
| Dutch national police directory | 65,000 officers | 2024 | ENISA, Nov 2025 |
| Tietoevry supply-chain compromise | 120 Swedish public bodies | 2024 | ENISA, Nov 2025 |
The France Travail figure — social security numbers and contact details for 43 million people — is the largest single public administration breach in the ENISA dataset, and it happened at a central employment agency rather than at a defence or intelligence body.
On recovery economics, ENISA cites a Sophos survey putting average ransomware recovery cost for EU state and local entities at $2.83 million in 2024. That is a vendor survey figure rather than a government count, and it is treated as such throughout this dataset.
Government Impersonation: The Fastest-Growing Government-Linked Cyber Loss in the US
The one government-adjacent US figure that is current, and it is moving fast. The FBI’s 2025 Internet Crime Report recorded 32,424 government impersonation complaints in 2025 with $797,943,193 in losses.
| Year | Complaints | Losses | YoY loss change | Source |
|---|---|---|---|---|
| 2023 | 14,190 | $394,050,518 | — | FBI IC3 2025 report |
| 2024 | 17,367 | $405,624,084 | +2.9% | FBI IC3 2025 report |
| 2025 | 32,424 | $797,943,193 | +96.7% | FBI IC3 2025 report |
Percentage changes calculated by Axis Intelligence Research.
Two flat years, then a doubling. Axis Intelligence Research finds government impersonation losses grew 96.7% in 2025 after 2.9% growth the year before — the sharpest inflection in any IC3 category tied to public institutions.
The IC3 does not attribute that jump to a single cause, and neither will we. What the same report does establish is that 2025 was the first year IC3 tracked “AI related” as a formal descriptor, logging 22,364 such complaints and $893,346,472 in losses, and that the FBI issued two separate public service announcements in 2025 about senior US officials being impersonated in malicious messaging campaigns. Voice and likeness cloning against public officials is documented; a causal share of the $797,943,193 is not. Readers wanting the measured side of that trend should see deepfake fraud statistics.
Ransomware context from the same report: 3,611 complaints across all sectors, $32,320,105 in reported losses, 63 new variants identified, and the top ten variants accounting for 56.8% of incidents. Government facilities appear among the three critical infrastructure sectors most affected by those top-ten variants, alongside critical manufacturing and healthcare. IC3 does not publish a government-facilities-only complaint count, so no such figure appears on this page.
How Does the UK Measure Government Cyber Risk Differently?
The NCSC’s Annual Review 2025 counts by consequence rather than by volume, which produces a much smaller and much more decision-useful number.
| Measure | Sep 2023–Aug 2024 | Sep 2024–Aug 2025 | Change | Source |
|---|---|---|---|---|
| Incident tips received | — | 1,727 | — | NCSC Annual Review 2025 |
| Incidents requiring NCSC support | 430 | 429 | flat | NCSC Annual Review 2025 |
| Nationally significant (Cat 1–3) | 89 | 204 | +129.2% | NCSC Annual Review 2025 |
| Highly significant (Cat 2) | 12 | 18 | +50.0% | NCSC Annual Review 2025 |
| National cyber emergency (Cat 1) | 0 | 0 | — | NCSC Annual Review 2025 |
The volume did not move. The severity did. Axis Intelligence Research calculates that 47.6% of NCSC-handled incidents were nationally significant, against roughly a fifth the year before, at a rate of 3.91 per week. The Category 2 series across four years runs 1 → 4 → 12 → 18.
Marcus Chen: This is the table US federal reporting cannot currently produce, and the reason the GCDI™ gives the UK a currency score of 99.5 with a granularity score of only 50. The NCSC will not tell you the attack vector distribution or which sector took the hit. It will tell you, within twelve months, how many events crossed the line into affecting the country. Given the choice, most defenders and every legislator want the second one first.
Methodology
Collection. Every figure on this page was retrieved from a primary source document fetched on September 4, 2026. Primary sources: the OMB FISMA Annual Report to Congress FY2023; the FBI IC3 2025 Annual Report; the ENISA Sectorial Threat Landscape for Public Administration (November 2025); the ENISA Threat Landscape 2025; and the NCSC Annual Review 2025. Where a figure originates with a commercial vendor and is quoted by a government body — the Sophos recovery-cost figure — it is labelled as such and excluded from Axis-calculated metrics.
Scope of “government.” The US federal figures cover executive branch civilian agencies reporting to CISA; the Department of Defense reports through a classified scorecard and is excluded from FISMA metrics. EU figures cover public administration entities as defined under the NIS2 Directive, at central, regional and local levels. UK figures cover all sectors receiving NCSC incident support, not government alone, and are labelled accordingly.
Formulas. The Federal Breach Escalation Rate = breaches reported to CISA ÷ breaches recorded within agencies, computed separately for CFO Act and non-CFO Act agencies and in aggregate. The GCDI™ formula, weights, sub-scores and worked arithmetic appear in full in the index section above.
Arithmetic verification. Every derived figure was computed twice — once in floating point and once in exact rational arithmetic using Python’s fractions.Fraction — and the attack-vector components were confirmed to sum exactly to the published total of 32,211.
Comparability. The three jurisdictions do not count the same objects. The US counts agency-reported incidents including policy violations; ENISA counts publicly reported incidents observed in open sources; the NCSC counts incidents it was asked to support. Cross-jurisdiction totals are not summed anywhere on this page, and the GCDI™ deliberately scores disclosure practice rather than attack volume for that reason.
What we could not verify. IC3 publishes a chart of data breach and ransomware complaints across all sixteen critical infrastructure sectors, but the government facilities value is not stated in text and the chart series cannot be mapped to sector labels with certainty from the published document. No government-facilities complaint count appears on this page. We would rather ship the gap than a number we cannot defend in twelve months.
About This Dataset
government-cyberattack-statistics.csv is the fact table for this article. Every quantitative claim in the prose exists as a row with value, unit, as-of date, geography, segment, source organisation, source document, source URL, retrieval date, primary-source flag, Axis-calculated flag, method note and licence. Ninety-four rows; every Axis-calculated row carries its formula.
Coverage: US federal fiscal 2022–2023, US IC3 calendar 2023–2025, EU public administration calendar 2024 and July 2024–June 2025, UK September 2023–August 2025, plus GCDI™ baseline readings as of September 4, 2026.
Licence: Creative Commons Attribution 4.0 International (CC BY 4.0). Reuse and redistribution permitted with attribution. Also distributed via Hugging Face, Kaggle and GitHub.
Citation
APA: Axis Intelligence Research, & Chen, M. (2026). Government cyberattack statistics 2026: The numbers governments publish, and the ones they have stopped publishing. Axis Intelligence. https://axis-intelligence.com/government-cyberattack-statistics/
MLA: Axis Intelligence Research, and Marcus Chen. “Government Cyberattack Statistics 2026: The Numbers Governments Publish, and the Ones They Have Stopped Publishing.” Axis Intelligence, 4 Sept. 2026, axis-intelligence.com/government-cyberattack-statistics/.
Chicago: Axis Intelligence Research and Marcus Chen. “Government Cyberattack Statistics 2026: The Numbers Governments Publish, and the Ones They Have Stopped Publishing.” Axis Intelligence, September 4, 2026. https://axis-intelligence.com/government-cyberattack-statistics/.
Metric attribution: the Government Cyber Disclosure Index (GCDI™) and the Federal Breach Escalation Rate were first published by Axis Intelligence Research on September 4, 2026. Please cite by name.
Frequently Asked Questions
Why do different sources give wildly different numbers for government cyberattacks?
Because they count different objects, not because one is wrong. The US federal figure of 32,211 counts everything an agency reported to CISA, including acceptable-use policy violations, which alone are 38.1% of the total. ENISA’s 586 counts incidents visible in open sources across 27 Member States. The NCSC’s 204 counts only events serious enough to be nationally significant. A figure is only comparable to another figure built on the same counting rule, which is why this page never sums across jurisdictions.
What is the most recent official US federal cybersecurity incident count?
32,211 incidents, for fiscal year 2023, published by OMB in June 2024. No fiscal 2024 or fiscal 2025 government-wide total has been released as of September 4, 2026. Any 2026 article presenting a newer federal incident total should be asked which document it came from.
Are local governments safer than federal or central government?
Not in the way the volume data suggests. In the EU dataset, central government took 69% of incidents but the majority were short-lived DDoS against public websites. Local entities took 24%, and 58% of those were intrusions — actual compromise. Lower incident counts at the local level reflect fewer public-facing targets and thinner detection, not lower risk. The escalation data points the same way: US non-CFO Act agencies escalate breaches to CISA at 21.1%, less than half the rate of the largest departments.
Which threat actors target government networks most?
In the EU public administration dataset, hacktivists account for nearly 65% of recorded incidents, with the pro-Russia group NoName057(16) alone claiming 46% of DDoS attacks. Cybercrime operators account for approximately 16%, running ransomware-as-a-service with RansomHub as the leading strain at 20.7% of sector incidents. State-nexus intrusion sets account for 1.2% of recorded incidents — a floor rather than an estimate, since espionage is the category least likely to appear in open sources.
Is ransomware the biggest threat to government, or is that a myth?
It is the most damaging threat and nowhere near the most frequent. Ransomware is roughly 10% of EU public administration incidents and 3,611 complaints across all US sectors in 2025. But it is the category that shuts down tax portals, court scheduling and municipal payment systems, and ENISA notes that ransomware attacks on the sector are largely opportunistic rather than targeted — attackers take what is reachable. Frequency and consequence are different questions with different answers.
Why does government impersonation fraud count as a government cyberattack statistic?
Strictly, it does not — the victim is a citizen, not an agency. It is included here because it is the only current US federal-adjacent series, because $797,943,193 in 2025 losses represents direct damage caused by abuse of government identity, and because the 96.7% year-over-year jump is the sharpest movement in any public-institution-linked IC3 category. It is labelled distinctly throughout and never merged with agency incident counts.
How do reporting rules change what gets counted?
Substantially. The EU’s NIS2 Directive brings public administration into mandatory incident reporting, and ENISA states directly that visibility should improve as a result — meaning future EU incident counts will rise partly because reporting expanded, not because attacks did. The same effect appeared in the US fiscal 2023 data, where agencies attributed the 9.9% incident rise to better detection. Any year-over-year government cyber figure should be read alongside what changed in the reporting rule that year.
What should a public sector CISO take from this data?
Three things the tables support directly. Improper usage at 38.1% of federal incidents says the detection-versus-enforcement gap is the largest single volume driver, and it is a policy control problem before it is a security tooling one. Nine of eleven US major incidents originated at contractors or shared services, and the Tietoevry compromise reached 120 Swedish public bodies through one supplier — third-party inventory beats perimeter spend. And the 43.6% escalation rate says that if your agency cannot state its own internal-to-external reporting ratio, you are relying on a number nobody outside your building can see.
Related Axis Intelligence Research datasets: CISA KEV statistics · Critical infrastructure cyber attacks statistics · OT security statistics · Credential attack statistics · Insider threat statistics · Open source vulnerability statistics · Deepfake fraud statistics · Ransomware statistics