It starts with a single click.
A clerk in the water department opens an invoice that looks real. A treasurer clicks a link to “verify” a bank transfer. And 15 minutes later, every screen in Town Hall goes black.
A message pops up: “Your files are encrypted. Pay $50,000 in Bitcoin to unlock them.”
For a small town, this isn’t just a computer problem. It’s a catastrophe. You can’t cut payroll. You can’t look up zoning permits. You can’t bill for water. You can’t access the voter rolls.
Small towns are now the #1 target for ransomware because hackers know a secret: We have million-dollar responsibilities but thousand-dollar IT budgets. They know we don’t have a Chief Information Security Officer. They know we are running Windows 7 on a computer in the basement.
We are the low-hanging fruit.
But being small doesn’t mean being helpless. You don’t need a Pentagon budget to secure your town. You need digital hygiene and offline redundancy.
The “Air-Gap” Is Your Best Defense
Cloud backups are great—until the ransomware infects the cloud, too. Modern malware is designed to hunt down your connected backups and encrypt them before it locks your main system.
The only file a hacker cannot touch is one that isn’t connected to the internet.
The Strategy:
Every Friday afternoon, your Town Clerk or IT consultant should perform a full backup of critical databases (financials, property records, meeting minutes) to an external hard drive.
Once the backup is complete, unplug the drive and put it in a fireproof safe.
That’s it. That is the “air gap.” If your network burns down on Monday morning, you have a clean copy from Friday that no hacker on earth can reach.
- Relation to [Governance Continuity]: If your digital records are held hostage, you cannot govern. An air-gapped backup allows you to wipe the infected machines, restore the data, and get back to work without paying a dime in ransom.
Paper Is Not Obsolete—It’s Redundancy
We have spent twenty years trying to go “paperless.” In a cybersecurity crisis, paper is the only thing that works.
If your financial software is locked, how do you pay the plow drivers? If your GIS server is down, how do you know where the water shut-off valves are?
Your town needs a “Continuity Binder”—a physical, printed set of essential operational data, updated quarterly:
- Vendor lists and account numbers.
- Employee payroll data (so you can hand-write checks if needed).
- Current ordinances and emergency contacts.
- Infrastructure maps (See The Lost Art of the War Room).
This binder is your lifeboat. When the digital ship sinks, you grab the binder.
- Relation to (Financial Continuity): The ability to issue manual checks or vouchers keeps the town’s economy moving when the electronic banking system is inaccessible.
Segregate Your Systems
In many small towns, the same computer used to manage the SCADA system (which controls the water treatment plant) is also used to check email.
This is suicidal.
If a hacker gets into your email, they can pivot to your water pumps. We have seen it happen.
The Fix:
- Operational Technology (OT) computers—those controlling water, sewer, or traffic lights—must be physically disconnected from the internet. No email. No web browsing.
- Public Wi-Fi at the library or town hall must be on a completely separate network from the administrative offices.
This costs almost nothing to configure but creates “blast doors” that stop an infection from spreading to life-safety systems.
- Relation to (Sanitation Is Civilization): Protecting your sewer lift station controls from cyberattack is just as important as maintaining the pumps.
Stop Using “TownName123” as a Password
It sounds trivial, but it is the primary entry point for attacks.
Small towns often share passwords. The “Treasurer” login is used by the Treasurer, the Deputy, and the temp worker. When one person is compromised, everyone is compromised.
The Policy:
- Unique Logins: Every human being gets their own username. No generic “FrontDesk” accounts.
- Multi-Factor Authentication (MFA): Turn it on. Everywhere. It is free for most email and banking platforms. It stops 99% of automated attacks cold.
The Bottom Line
Cybersecurity vendors want to sell you expensive “threat monitoring” software. And if you have the budget, buy it.
But if you are choosing between a firewall subscription and a new ambulance tire, you need a different approach.
You cannot buy your way out of this risk. You have to behave your way out of it.
- Unplug your backups.
- Print your essentials.
- Separate your systems.
Don’t wait for the screen to go black to realize how fragile your digital town really is.