SonicWall Research Finds State, Local and Education (SLED) Cyber Attacks Surge 242% in First Half of 2026

SonicWall released its 2026 State and Local Government (SLED) Protect Brief, a vertical-specific companion to the SonicWall 2026 Cyber Protect Report. The report found that state and local government attack volume rose 242% year-over-year, with over 300 million High/Medium priority intrusion prevention (IPS) in the first half of 2026.

Across most industries, attackers have grown more selective, trading volume for precision. State and local government broke that pattern entirely. Budget-constrained IT teams, a wide mix of legacy public-facing systems, and inconsistent patch cycles across departments are making the sector a growing target. The brief draws on data from SonicWall's global network of more than one million security sensors.

"State and local government is the one place where the data does not show attackers backing off," said Michael Crean, SonicWall SVP of Managed Services. "State and local government networks are taking the brunt of attacker focus. State and local IT teams are being asked to defend expanding digital footprints with limited resources, relying on aging public-facing systems and inconsistent departmental patch cycles. Attackers recognize these structural friction points, and they are actively exploiting them."

Key Findings from the 2026 SonicWall SLED Protect Brief

• State and local government IPS volume rose 242% year over year in the first half of 2026, climbing over 300 million hits.
• Recorded 162,062 IPS hits per firewall, higher than any enterprise vertical in this cycle, with web attacks accounting for 85.1% of IPS volume.
• Apache Log4j2 (Log4Shell) generated 19.5 million hits across 585 firewalls, indicating Java-based government middleware still exposed more than four years after disclosure.
• Malware detections reached 57.7 million, up 8.6% year over year, with nearly 90% classified as Trojan-class malware built to steal credentials and maintain a hidden foothold.
• Ransomware hits fell 74%, yet six families remained active between January and May 2026: JScript, Gandcrab, Ryuk, Filecoder, PyAesCrypt and MalAgent.

Old Doors, Still Unlocked

Apache Log4j2 (Log4Shell) generated 19.5 million hits across 585 government firewalls, more than four years after the vulnerability was disclosed and emergency-patched industry-wide. Java-based case management, permitting and records systems common in state and local government continue to run unpatched instances at scale, a sign of patch cycles that lag disclosure timelines by years, not weeks. Outside North America, the threat profile shifts: in EMEA, SIPVicious VoIP fraud signatures account for roughly 20% of IPS volume, six times the North American share, while in the UK four of the top 15 signatures by volume or breadth are cross-site scripting variants.

Malware tells a quieter story. Nearly 90% of the 57.7 million malware detections were Trojan-class, software designed to maintain persistent access that pays off later through follow-on ransomware, data exfiltration or resale of stolen credentials. Ransomware made up only 7% of malware volume, and its fragmented landscape suggests opportunistic, automated targeting rather than one outbreak. Smaller does not mean absent: municipal and county governments remain attractive targets because service disruption creates outsized public pressure to pay.

The Architecture Problem Has a Known Solution

Many state and local agencies share network infrastructure across finance, permitting, public safety, parks and recreation, often behind a single VPN concentrator that grants broad access the moment credentials are validated. Zero Trust changes the architecture, not just the policy: access is granted at the application level and tied to continuously verified identity and device posture, so a stolen login for one department's application does not unlock the network behind it. SonicWall Cloud Secure Edge delivers that model, and the brief outlines five actions agencies can take now, from replacing flat VPN access to maintaining offline, immutable backups with EDR rollback.

"Government networks were built to share, and attackers are exploiting exactly that," said Crean. "Public-sector IT teams are being asked to do more with less while defending systems that were never designed for today's threat landscape. Zero Trust does not require agencies to replace everything at once. It requires that one compromised credential never again become a compromised department, or a compromised city."