If a database exists, it can be hacked and exfiltrated. With attacks ramping up on states and municipalities, which are often behind on security updates, they also don't give their 70yo clerical staff proper infosec training to avoid social engineering techniques, nor do they pay them enough to care.

I would look to recent reports of attacks on local governments, rather than studies. Politicians aren't exactly skilled at understanding studies, but exciting news headlines might be enough to grab their attention. !cybersecurity@sh.itjust.works might be a good place to start!