Here’s a pretty staggering number: 34,220,504.

That’s the number of personal records exposed, according to the Identity Theft Resource Center, through November 2015 because of government data breaches.

While that number does include some pretty high profile federal breaches, it also includes many more at the local level that didn’t make national headlines. Clearly, governments are going to be popular targets for hackers. The breadth of data they have on their citizens makes them enticing.

Unfortunately, local governments are also some of the easiest targets. We recently took a look at some of the data that we have from the networks we protect, and it bore that out. By far, the Sentinels that tripped the most alerts were those that were protecting local governments and educational facilities. Those networks were four times as likely to be infected with Cryptowall and were responsible for 95 percent of all Kovter attacks that we saw.

Why is that these local government networks are so vulnerable? From our experience, it’s because there are six common security misconceptions believed by local government employees that keep them from securing their networks. Over the next few posts, we will share those misconceptions with you and also provide ways that you can battle them.

Misconception No. 2: I know exactly where my data is.

There’s one commonality among all the news stories about federal government data breaches. In each instance, officials knew exactly what kind of information was compromised. If those stories had been about local governments instead, the information wouldn’t have been so detailed.

That’s because at the federal level, network administrators usually know exactly what information is living where. If Server A was breached then that means names and addresses were compromised. Server C it’s Social Security data.

At the local level, you may believe that you know where your data is, but you don’t. Not specifically. With single servers handling multiple departments and applications, knowing where data is to the level of detail that the federal agencies have isn’t possible. A single breach of a single server could mean that information from several departments has been compromised.

How to combat this misconception: To some degree, the local officials aren’t necessarily to blame. This is a misconception that can be blamed on dollars and cents. Buying a server for a single department or application is expensive, too expensive for many. Why buy four SQL servers when you only need one?

The solution: virtualization. Run virtual machines, splitting up your apps across the VMs, and segmenting the data. For example: If you’re using SQL servers, you are going to need to protect those databases. That means putting something on the wire that can recognize the difference between normal and abnormal calls and then something on the server that can segregate databases and permit only those with permission to access the tables.