The FBI said this month that attacks that involve encrypting a computer and demanding money to unlock it are “becoming more targeted, sophisticated, and costly.” The alert notes that “since early 2018, the incidence of broad, indiscriminate ransomware campaigns has sharply declined, but the losses from ransomware attacks have increased significantly.”

As The Hill reports, while the FBI has previously warned of business email breaches and attacks on websites considered more “secure,” this was the agency’s first alert of the year to focus on ransomware. On the heels of the alert, Alabama-based DCH Health System revealed that it had paid off the hackers behind a ransomware attack that crippled operations at three hospitals. The company didn’t disclose the amount, reports local WHNT News.

The FBI recommended against paying the ransom. To prevent attacks, the agency urged organizations to keep their software updated and their systems backed up, as well as to train employees on how to spot ransomware attacks.

The bureau’s last ransomware alert was in September 2016, when it called on victims to report incidents so it could accurately assess the threat landscape, notes tech journalist Davey Winder at Forbes.com. In the latest warning, the FBI said that while ransomware attacks done without a specific target, such as WannaCry in 2017, have “sharply declined,” the damage from ransomware attacks has soared as they’ve gotten “more targeted, sophisticated and costly.”

Ransomware has affected at least 621 organizations so far in 2019, with an estimated total cost of $186 million, according to research by cybersecurity firm Emsisoft. Recent targets of ransomware attacks have included more than 20 small Texas towns as well as multiple school districts in Louisiana. The city governments of Baltimore and Atlanta suffered from ransomware attacks this year and opted not to pay off the hackers.

The FBI said that “healthcare organizations, industrial companies and the transportation sector” are now also being targeted. More rural areas, like Alabama, could also be at risk. Joshua Crumbaugh, CEO of cybersecurity firm PeopleSec, told WHNT News, “Especially with small cities and municipalities, this is absolutely just the beginning of what we are going to see... they’re the low hanging fruit.”