Skip to content

DysruptionHub’s Cyber Incident Registry completes its historical backfill

More than 600 researched profiles now connect past coverage with ongoing follow-up, alongside new ways for Sustainers to follow the reporting.

Registry totals of 633 incidents, 765 affected organizations and 55 states and territories beside Cocoa’s incident profile, with five timeline dates from February through June 2026.

DysruptionHub’s Cyber Incident Registry now contains more than 600 researched profiles, all free to read, following the completed backfill of more than two years of past coverage.

When I introduced the registry in August, bringing those older incidents into it was one of the main tasks ahead. That reporting is now easier to find, compare and connect with later developments.

Registry coverage statistics showing 633 incidents, 765 affected organizations and documented impact across 55 states and territories.
Registry coverage snapshot, Nov. 10, 2026. These figures describe documented records, not the prevalence of cyber incidents nationwide.

Follow incidents beyond the headlines

Each incident profile brings together what happened, who was affected, the disruption to operations and the sources behind the account. Connections to organizations, locations, sectors and named threat actors help readers explore related cases.

Profiles can be updated as more becomes known, bringing service restorations, later disclosures and new evidence into the record after the initial headlines have passed.

The backfill covers past DysruptionHub reporting. New incidents still need research, and existing records need follow-up, corrections and maintenance.

Following early disruptions

The upgraded Early Warning Watchlist tracks disruptions that may point to an undisclosed cybersecurity incident. Sustainers can review the reporting and follow what becomes known, including whether a disruption is later confirmed as cyber-related.

An entry on the Watchlist does not mean a cyberattack has occurred. It gives readers a way to follow the reporting as the cause and consequences become clearer.

Updates that come to you

New browser notifications and private RSS feeds give Sustainers more ways to follow incidents, articles and Watchlist entries. Incident and article coverage can focus on the states and territories that matter to you.

Private article feeds provide full-text reporting, while public article RSS feeds contain excerpts. Incident feeds bring briefings, key facts and links to case files into your RSS reader.

Not every incident in the registry becomes a standalone article. Following registry entries alongside articles helps readers keep up with cases they could otherwise miss.

Free to read, supported by readers

The registry and its complete incident profiles are now free to read. Sustainer memberships provide the additional tools described above and help fund the work behind this public resource.

Keeping this resource useful takes ongoing research and follow-up, as well as hosting, monitoring and delivery costs. Memberships help support that work, and I’m grateful to the readers already contributing.

You can explore the Cyber Incident Registry or become a member to help keep the records current.

Joseph Topping

Joseph Topping

Joseph Topping is the founder and editor of DysruptionHub, reporting on cyber incidents and technology failures that disrupt public services, organizations and daily life.

All articles

More in Analysis

See all

More from Joseph Topping

See all