Cybercrime is a growing problem, with reported global losses reaching nearly $21 billion in 2025, and projected to hit $14 trillion by 2028. Public entities are considered "low-hanging fruit" opportunities for hackers because they typically have legacy systems that are no longer supported by the software and hardware manufacturers. With no updated software patches, hackers can break into their systems, steal data, lock them up with malware, and demand a ransom.
Many public entities (villages, towns, cities, counties, schools, etc.) have limited budgets for IT. This includes upgrading systems, hardware, implementing cybersecurity protocols, and educating their users on how to identify a potential phishing email scam. Without all of this in place, the unfortunate result is experiencing a cyber event that shuts down the services public entities provide to their constituents.
With the use of AI phishing schemes, fileless attacks, and ransomware-as-a-service, hackers are executing targeted attacks on many public entities.
A perfect example of how a targeted cyber-attack can cripple a company occurred on May 7, when Instructure, the company behind Canvas (a popular education platform), was hacked by a group called ShinyHunters, which threatened to release student data.
The attack is considered the largest educational data breach on record, impacting 8,809 institutions globally and 30 million users. School districts and municipalities didn't get hacked directly—their trusted vendor did. A single compromised vendor can cascade across thousands of public organizations simultaneously, so verifying your policy extends to third-party vendors is critical.
Public entities require a cyber policy that has the necessary endorsements to mitigate their financial exposures following a cyber incident. The first issue we generally discover when working with our prospective public entity customers is that they have low cyber limits e.g., a $1M limit. With the large amount of Personally Identifiable Information (PII) such as credit card account numbers, banking information, etc., a $1M limit is not sufficient.
Ransoms in the public entity space on average are more than $5M. There are also additional costs following a cyber incident that include credit monitoring, fines/penalties, notification costs, data breach coaches, and forensics. Without having adequate cyber limits, the cost burden falls on taxpayers.
Cybercrime is an epidemic. In today's digital environment, public entities—from schools to municipalities—are prime targets for cyberattacks. At World, our role goes beyond placing a policy. We partner with you from day one, starting with a cyber insurance check-up, reviewing your current policies and endorsements to identify any gaps or exposures.
From there, we bring in (or recommend) a cybersecurity specialist to assess your environment and uncover potential vulnerabilities. Finally, we work closely with underwriters to secure the most comprehensive and competitive policy tailored to your needs.
When a cyber event happens (often at the worst possible time, like nights, weekends, or holidays), our clients contact us immediately so we can activate the carrier's response team without delay. In a cyber incident, timing is critical, so the faster we respond, the better we can contain the threat, limit damage, and reduce the risk of further data loss.