Cybersecurity · Oct 3, 2026Vicksburg Ransomware Attack: Who Gets Hit by Cyberattacks, and What the Data Does and Doesn’t Show About Race

Cybersecurity · Investigation · October 3, 2026, 1:40 PM CDT

Key Facts

• The City of Vicksburg, Mississippi, shut down its computer systems on October 1, 2026 after a ransomware attack. Emergency services were not affected.^[1][2]
• Vicksburg is 66.9% Black (non-Hispanic) in the 2020 Census, against about 13.7% nationally.^[6][16]
• We found no federal dataset that records the race of ransomware victims or the demographics of attacked cities. The FBI’s 2024 and 2025 reports contain no such breakdown.^[4][5]
• Across the states, a larger Black population share does not predict more reported cybercrime per resident (r = +0.07, not significant). Reporting rates differ widely: 8.8 times between the highest and lowest state.^[4][6]

When a ransomware attack froze the computers of a small Mississippi river city, a harder question followed: does this kind of attack fall unevenly across America, and does race have anything to do with it?

We started with Vicksburg, then went to the national data. The honest answer has three parts. The attack itself is well documented. The pattern across states is real: it does not line up with Black population share, but it does line up with Hispanic population share, for reasons the data cannot explain. And the data that would settle the question for cities and individuals does not exist in public form.

1. What happened in Vicksburg

Mayor Willis Thompson announced on Thursday, October 1, 2026 that the city was investigating a cybersecurity incident. The Record reported it was a ransomware attack that led the city to shut down its systems.^[1]

The city said 911 dispatch, police and fire departments were not affected. Residents paying utility bills in person could face delays, and the city said “there will be no penalties or termination of services while this system is offline.”^[3]

The mayor told local reporters, “We had to bring our internet operations down, just for protection.”^[3] The city’s water and gas office manages more than 10,000 utility accounts.^[3]

The city is working with the FBI, the Department of Homeland Security, state officials and private cybersecurity experts. Its statement lists the investigation’s top priority:^[1]

One of the top priorities of our investigation is determining whether there was any compromise of personal or confidential information relating to current and/or former customers, contractors, vendors, employees, or affiliated business partners of the City.^[1]

It added that “the City has not reached a final determination regarding what information, if any, may have been accessed or acquired without authorization.”^[1]

What nobody has said yet

• No ransomware group has claimed the attack, and the city did not answer questions about a ransom demand or the attackers’ identity.^[1]
• DataBreaches.net noted it is unclear whether this was an encryption attack or a ransom demand without encryption.^[3]
• We do not know whether personal data was taken. The city says its investigation is ongoing.

Mississippi has been here before. The Record notes earlier Mississippi incidents, including a ransomware attack on the University of Mississippi Medical Center.^[1]

Video: WAPT News Jackson — a report on ransomware that crippled Adams County, Mississippi, systems.

2. Who lives in Vicksburg

Vicksburg had 21,573 residents in the 2020 Census. About 66.9% were Black (non-Hispanic) and 27.7% were White (non-Hispanic). The city’s median household income was $42,484 and about 27.9% of residents lived at or below the poverty line in the 2023 American Community Survey, as summarized on the city’s Wikipedia page.^[16]

Mississippi as a whole is about 37.7% Black in the Census Bureau’s 2024 estimates, the highest share of any state except DC. The U.S. figure is 13.7%.^[6]

Those facts matter for one reason: a city like Vicksburg has a smaller tax base to pay for IT staff and security. That is a hypothesis about vulnerability, not a finding about why Vicksburg was chosen, and the next sections test what the data supports.

3. The national picture

The FBI’s Internet Crime Complaint Center received more than 3,600 ransomware complaints in 2025, with reported losses above $32 million. It cautions that the figures cover only what victims report, and that many report no loss.^[5]

Ransomware groups also post victims on their own leak sites. The tracker ransomware.live logged 2,809 U.S. victims in 2024, 3,886 in 2025, and 2,941 so far in 2026, through October 3. Those are the criminals’ own claims, not confirmed attacks.^[7]

Government and defense entities were 110 of the 2024 listings, 151 of 2025’s and 105 of 2026’s so far. That is roughly 4% of the total, so governments are a small share of listings but a visible and disruptive one.^[7]

Comparitech counted 187 government organizations hit by ransomware worldwide in the first half of 2026. The U.S. accounted for 58 of them, or 31%, and 33 of the 58 were confirmed. The median ransom demand was $100,000, down from $500,000 in the second half of 2025. The largest data breach was the City of Suffolk, Virginia, with 157,725 people affected.^[8]

4. Which cities get hit

No public dataset lists ransomware victims by city together with their demographics. To get as close as we could, we parsed ransomware.live’s government listings for official web domains that carry a state code, such as an “.al.gov” or a “.us” address ending in a state abbreviation.

That gives 95 distinct government domains. It is a floor, and it skews toward entities that run their own domain. It still shows the spread: victims in every region, in cities and counties of very different sizes.

We then pulled the 2020 Census demographics for eight named cities and towns that appear in the data or in news reports. The set is hand-picked and cannot support a conclusion about targeting. It does show who is on the list.

Read the table plainly. Majority-Black cities appear, and so do cities where Black residents are 3% of the population. The pattern we can see is that ransomware groups hit small and mid-sized local governments across the country.

5. State by state: a very uneven map

The FBI’s 2024 report gives complaints and losses for every state, plus rates per 100,000 residents. Rates ran from a low of 104.2 in Mississippi to a high of 914.7 in Alaska, a 8.8-fold gap. The median state was 180.^[4]

Mississippi has the lowest reported rate of any state, 104.2 per 100,000, from 3,068 complaints. Its reported losses per resident are the ninth lowest.^[4]

That does not mean Mississippi has the fewest attacks. The FBI’s complaint counts reflect who reports. Reporting depends on awareness, trust in agencies and access to help. A state at the bottom of this table could be safer, or it could be reporting less. The data cannot tell those apart.

6. Race and ethnicity: what the numbers can and cannot say

We joined the FBI’s state data to the Census Bureau’s 2024 population estimates and tested whether a state’s racial makeup lines up with its reported cybercrime rate. The charts below are interactive: drag the 3D plot to rotate, hover for each state, and use the dropdown on the map above.

Black population share

There is no statistically significant relationship. Across all 51 jurisdictions, the correlation between Black population share and complaints per resident is r = +0.07 (p = 0.63). With DC removed it is r = -0.12 (p = 0.40).^[4][6]

Losses per resident look different only because of DC, which reports $41.5 million per 100,000 residents. Drop DC and Black share has no relationship with losses either.

Hispanic population share

One pattern does show up. States with larger Hispanic populations report higher losses per resident. Without DC the rank correlation is rho = +0.69 for losses and +0.50 for complaints (both p < 0.001).^[4][6]

Why this is not proof of anything about people

• States are not people. A state-level pattern can mask the opposite pattern among individuals. That error has a name, the ecological fallacy.
• Complaints are not attacks. They measure reporting.
• Hispanic share travels with other things. The states that lead on it are concentrated in the South and West, with different ages, industries and internet use. We did not control for those.
• The FBI does not publish victim race. Neither the 2024 nor the 2025 report breaks complaints down by race or ethnicity.^[4][5]

7. Individuals: what peer-reviewed and federal survey data show

The only national data by race is for individual victims, not governments. The Bureau of Justice Statistics found that 10.3% of White persons were victims of identity theft in 2021, against 8.2% of Black persons, 6.1% of Hispanic persons and 6.5% of Asian or Pacific Islander persons. People of other or multiple races had the highest rate, at 13.0%.^[9]

Being less often a victim is not the same as being safer. A peer-reviewed study of scam reports to the Federal Trade Commission found that consumers classified as Black, Hispanic and Asian were more likely than non-Hispanic White consumers to report that they were victimized, not merely targeted.^[10] In other words, when scammers reached them, more lost money.

A 2026 survey of 470 adults in the Journal of the Colloquium for Information Systems Security Education found Asian/Pacific Islander respondents faced higher odds of identity theft and phishing losses, and that Hispanic/Latinx and rural respondents reported lower adoption of security tools.^[11] It is a small sample, so treat it as a lead, not a measurement.

8. Why small cities are exposed

Researchers at the University of Houston’s Hobby School studied the August 2019 attack that hit nearly two dozen Texas municipalities at once. They wrote that municipal governments “represent some of the easiest targets for cybercriminal organizations,” and pointed to funding: municipalities are “often poorly funded and face significant obstacles” hiring capable IT staff.^[12] That is a policy white paper, not a peer-reviewed study.

The academic literature on this is thin. A 2024 systematic review in Applied Sciences said there has been “very little study on cybersecurity issues from the local government perspective.” A 2023 survey chapter asked whether municipal cybersecurity is “a neglected research area.”^[13][14]

One 2025 study of about 7,000 municipalities in Spain found that IT budget showed no significant correlation with outside-facing risk, while geography was a key predictor.^[15] It studied Spain, not the United States, so it cannot be applied directly. It does warn against assuming money alone explains exposure.

9. What each reading gets right

The “resources” reading. Places with small tax bases cannot afford security staff, and attackers go where defenses are thinnest. The Hobby School work supports the idea that funding gaps matter. Vicksburg’s income and poverty figures fit that story, though they do not prove it.

The “opportunity” reading. Attackers choose by technical exposure and ability to pay, not by who lives in a town. The state-level data, the mixed list of named victims and the Spanish study fit that story.

Both can be true. Neither requires attackers to know or care about race. The risk to watch is an unequal impact: when a city with fewer reserves loses weeks of utility billing, its residents feel it more.

What is not yet known

• Who attacked Vicksburg, whether data was taken and whether a ransom was demanded.
• Whether any federal agency holds incident-level data with place identifiers that could be joined to Census demographics. If so, it has not published it.
• Whether low complaint rates in states like Mississippi reflect fewer attacks or less reporting.

What data would settle the race question

• A public list of ransomware incidents against local governments, with city, date and confirmation status.
• The same list joined to Census place demographics and municipal budgets.
• Victim-level reporting that records race and ethnicity for individuals, with privacy protection.

Watch: ransomware and local government

Video: ABC7 News Bay Area — the City of Oakland says its ransomware attack is contained as services slowly come back online.

Video: GovernmentTechnology — “Inside the Local and State Government Ransomware Battle.”

What You Can Do Right Now

If you live in Vicksburg

1. Pay only through official city channels. Be wary of calls, texts or emails about utility bills while systems are down. Check the city’s official website or call a number you trust.
2. Keep receipts for every utility payment. The city says there will be no penalties or shutoffs while its system is offline.
3. If the city notifies you of a data compromise, follow the steps it lists, and consider a credit freeze at the three credit bureaus.
4. Do not click links in messages claiming to be from the city about the incident.

If you work for a city or county

5. Use the FBI’s checklist. Keep offline, encrypted, immutable backups, turn on multi-factor authentication, patch known exploited vulnerabilities, segment networks and remove default passwords.^[5]
6. Report incidents to the FBI’s Internet Crime Complaint Center. Reports are the data that tell the public where attacks fall.^[5]

If you are a reporter or researcher

7. Ask agencies for place-level incident data. That is the missing piece for any claim about race.
8. Read our data. We published the state table and the leak-site snapshot so others can check and extend our work.

How to Verify This Yourself

• Open the FBI’s 2024 Annual Report and read pages 20 to 23 for the state tables.
• Download the Census Vintage 2024 file and compare each state’s population by race.
• Search the 2024 and 2025 FBI reports for “race” or “ethnic” to confirm there is no victim breakdown.
• Check our figures against the datasets in the project folder content/data (state table and the dated ransomware.live snapshot).

References

1. Greig J. “Mississippi mayor says ransomware incident led city to shut down systems.” The Record from Recorded Future News, October 2, 2026. Secondary (news report quoting the mayor’s statement). therecord.media
2. WLBT, “City of Vicksburg hit by ransomware cyberattack, mayor says,” October 2, 2026. Secondary (local TV report). wlbt.com
3. DataBreaches.net, “City of Vicksburg, Mississippi, shuts down computers after cyberattack,” October 2, 2026. Secondary (news report). databreaches.net
4. FBI Internet Crime Complaint Center, 2024 Internet Crime Report, state statistics, pp. 20–23. Primary (federal data; complaints are self-reported). ic3.gov
5. FBI Internet Crime Complaint Center, 2025 Internet Crime Report, ransomware section, p. 14–15. Primary (federal data). ic3.gov
6. U.S. Census Bureau, State Population by Characteristics, Vintage 2024 (file sc-est2024-alldata6). Primary (federal data). census.gov
7. ransomware.live, U.S. victim listings, API snapshot of October 3, 2026. Secondary (a tracker of criminals’ leak-site claims, not confirmed incidents). ransomware.live
8. Moody R. “Government Ransomware Roundup: H1 2026 stats on attacks, ransoms, and data breaches.” Comparitech, July 16, 2026. Secondary (research-organization report). comparitech.com
9. Bureau of Justice Statistics, “Victims of Identity Theft, 2021.” Primary (federal survey). bjs.ojp.gov
10. DeLiema M, Witt P. “Profiling consumers who reported mass marketing scams: demographic characteristics and emotional sentiments associated with victimization.” Security Journal, 2023. Primary (peer-reviewed). doi.org
11. Mitta VSKR, Dupuis M. “Unequal Risks.” Journal of the Colloquium for Information Systems Security Education, 2026. Primary (peer-reviewed; survey of 470 adults). doi.org
12. Ocampo H, Bronk C. “’Holy Moly’ – Municipal Organizations and the Cyber Ransomware Problem.” University of Houston Hobby School of Public Affairs, White Paper No. 16, September 2021. Secondary (university policy paper, not peer-reviewed). uh.edu
13. Hossain ST, Yigitcanlar T, Nguyen K, Xu Y. “Local Government Cybersecurity Landscape: A Systematic Review and Conceptual Framework.” Applied Sciences, 2024. Primary (peer-reviewed review). mdpi.com
14. Vestad A, Yang B. “Municipal Cybersecurity—A Neglected Research Area? A Survey of Current Research.” Springer, 2023. Primary (peer-reviewed chapter). springer.com
15. Sánchez-Zurdo J, San Martín J. “Beyond Geography and Budget: Machine Learning for Calculating Cyber Risk in the External Perimeter of Local Public Entities.” Electronics, 2025. Primary (peer-reviewed; studies Spain). mdpi.com
16. Wikipedia, city pages for Vicksburg MS, Suffolk VA, Miami Gardens FL, Oak Park MI, Forest Park GA, Alexander City AL, Oakland CA and Sheboygan WI, quoting 2020 Census figures. Secondary (we could not open the Census Bureau’s own QuickFacts pages). wikipedia.org

Investigative methodology: Vicksburg facts come from the three news reports above. State figures were parsed from the FBI’s PDF tables and spot-checked against the PDF. Population figures come from Census files. Quotation marks mark exact wording from the pages we read. Leak-site listings are criminals’ claims. Correlations are state-level and cannot show why any person or city was targeted.

Kemetic Minds Editorial Desk

Verified Newsroom

Primary-sourced investigative intelligence on civil rights, voting rights, federal policy, and consumer protection. Sourced from primary legal filings, government statistics, and direct field reporting.

Editorial Standards & Policy → Join Telegram Alerts