Cyber Incident Registry

Greenville County Schools temporarily suspended Gmail for students and employees on Sept. 9 after phishing messages circulated through the district system. The district said it was not hacked, retained Google Classroom, documents and files for students, and had not determined whether any recipient acted on the messages.

Hilltop National Bank kept branches closed and banking systems offline Sept. 10 after a cybersecurity incident disrupted online and mobile banking, phone, email and scheduled payments. Debit cards and ATM withdrawals remained available under a combined $1,000 daily limit; the bank had not provided a restoration estimate, attack method, data-impact finding or attribution.

A Sept. 7 cyberattack disrupted the Mississippi Office of Student Financial Aid's ability to process applications and payments, although the separate MAAPP portal continued accepting applications and no individual university impact was reported. IHL and outside specialists were investigating the scope and possible exposure of confidential or sensitive data.

The City of Everett, Massachusetts, kept City Hall closed to the public Sept. 9-10 after a cybersecurity incident affected its internal network and technology systems. Basic municipal services shifted to the Connolly Center while police, fire, public works, schools and libraries continued operating normally; investigators were still working to restore city operations.

Springfield Public Schools kept its 64 schools closed through Sept. 11 after an outside group gained network access and blocked essential online programs. Officials expected classes to resume Sept. 14 after some critical systems, including student medical records, were restored, but broader recovery and the data-impact scope remained unresolved.

Westfield Public Schools experienced a district-wide technology disruption beginning Sept. 1, 2026, that disabled internet, Wi-Fi, phone service, instructional tools and the student information system while schools continued operating with manual workarounds. INC Ransom claimed the district as a victim, but the district has not confirmed ransomware, data theft or the actor's responsibility, and additional systems remained under restoration after phones returned Sept. 7.

A cybersecurity incident disrupted Luminis Health systems beginning Aug. 31 and continued affecting patient services through Sept. 10, with MyChart and CareConnectNow unavailable. Patients were rerouted and cancer treatment and imaging were delayed or canceled, although hospitals remained open; the mechanism, data impact, ransomware involvement and responsible actor remained unresolved.

McKesson discovered unauthorized access to third-party applications on August 25, 2026, and confirmed exfiltration of data associated with a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units. Customers experienced intermittent service degradation, but McKesson said August 29 that they could use systems and services as intended while orders, distribution centers and shipping remained operational. ShinyHunters claimed responsibility and alleged a $55,236,150 data-extortion demand, but McKesson has not attributed the incident or confirmed ransomware deployment.

The Bureau of Alcohol, Tobacco, Firearms and Explosives shut down a breached standalone system containing information about targets of ATF investigations, creating a limited loss of an internal investigative resource while the agency retained its broader mission capability. Qilin later began publishing files that CNN and an independent researcher said appeared to contain ATF investigative material. ATF has not authenticated the files or attributed the incident, and no public evidence establishes ransomware encryption.

The City of Circleville, Ohio, confirmed ransomware activity affecting portions of its municipal technology environment. The city said operations were restored, affected systems were rebuilt or recovered, no ransom was paid and it was not aware of evidence establishing that sensitive information was exfiltrated. The exact incident and detection dates remain unresolved.

Refrigeration failures were reported at at least 14 Defense Commissary Agency stores across 10 states beginning August 26, 2026, restricting chilled and frozen food sales, halting Click2Go at one store, forcing inventory transfers and causing product loss. Three military criminal investigation agencies later confirmed investigations, and Fort Irwin used emergency food orders after repairs were completed August 31. DysruptionHub assesses it is likely (55–80%), with medium confidence, that malicious or unauthorized cyber activity contributed; no public evidence confirms a malicious cause or common mechanism.

Boston Scientific's Aug. 25 cyberattack disrupted manufacturing, order fulfillment, shipping and new cardiac-device remote-monitoring activations. The company said Sept. 9 that those business operations and activation capability were restored and normal communications had resumed, although it continued reducing order backlogs, restoring some applications and investigating the incident.

Merrimack County, New Hampshire, confirmed unauthorized activity after a network security incident disrupted county systems, temporarily blocked dispatchers from criminal-records data and forced the Register of Deeds to accept only paper filings in person or by mail. The deeds office still published that paper-only restriction September 2, while dispatch call taking and emergency response remained fully functional. Any personal-data breach, ransomware involvement and attribution remain unresolved.

UC Berkeley began comprehensive containment Aug. 26 after endpoint-security tools detected suspicious activity in Electrical Engineering and Computer Sciences infrastructure, restricting network access and taking systems offline. By Sept. 8, the university said most services and research-critical systems had been restored, but some faculty pages remained down and restoration continued. UC Berkeley reported the incident to law enforcement but had not attributed a threat actor or determined whether data was exposed.

Franklin Mint Federal Credit Union lost website, mobile-app, email, text and digital-banking access beginning August 24 after fmfcu.org transferred registrars and routed to a domain-sale page. FMFCU restored its website and digital banking by August 26, and its current FAQ no longer identifies a remaining unavailable service; core systems, funds and transactions remained available throughout. The incident is presumed resolved operationally, while the cybersecurity investigation, transfer authorization and possible data impact remain unresolved.

Alation confirmed unauthorized activity in one of its systems after an Aug. 18, 2026, service incident degraded Alation Cloud availability for a limited number of customers in its Americas U.S.-East region. Alation restored affected services within an hour, but the public record does not establish whether the unauthorized activity caused the disruption or whether any data was accessed or removed.

Algonac officials said the city water filtration plant experienced a cyberattack targeting cellular modems used to communicate with remote PLCs, but the incident was contained without significant operational impacts. The timing, device class and UIS SCADA remediation closely match the late-July 2026 water-utility campaign, though no public authority has named Algonac as a confirmed campaign victim.

The City of Fort Scott shut down City Hall and its core network after detecting ransomware Aug. 18. Several non-critical machines at municipal sites were affected, while public safety and SCADA remained isolated; officials said full operations were restored by Aug. 23.

Lansing Urgent Care shut down its system after detecting an outsider's attempt to access its network, but did not identify the shutdown's date, duration or effect on patient care. INC Ransom had listed the provider about 24 hours before the first public account, yet the displayed administrative documents do not prove ransomware, data theft or INC's responsibility. No continuing clinic or patient-facing disruption was found by August 30, so the incident is presumed resolved operationally while forensic and attribution questions remain open.

Fort Smith last documented disrupted city systems and offline card readers August 17. Current city service pages again direct residents to ordinary online and telephone channels, and the absence of a later continuing impact supports presumed resolution.

Classes resumed Aug. 24, major services returned and the current technology-alert page showed ordinary planned maintenance rather than continuing incident recovery. The incident is presumed resolved, although the university has not issued an incident-wide all-clear.

A cyberattack disrupted the Town of Andover and Andover Public Schools' shared network for four days beginning Aug. 13, 2026, affecting email, online payments and teacher assignments. Wallstreet later listed Andover on its data-leak site and claimed possession of several data categories, but the claim has not been independently verified.

Limited town-office service was last documented August 21, but the Town Office page again advertised normal hours, card payments and online forms by August 31. With no later continuing disruption reported, the incident is presumed resolved.

Namecheap services and customer websites worldwide went offline August 13 during a cooling-system failure at its Phoenix data center. An early Namecheap status notice reportedly attributed separate Private Email and Jellyfish disruption to a DDoS attack, but the broad outage and staged restoration were tied to unsafe temperatures; full service was reported restored August 14.

Plymouth County Correctional Facility shut down its computer system after detecting unauthorized server access on August 13, suspending in-person visits because staff could not retrieve visitor-clearance records. Attorney visits and incarcerated people's tablet and phone access continued, while state police, the FBI and the Department of Homeland Security investigated. The public record does not establish ransomware, extortion, a threat actor or whether information was acquired.

Darlington County said on August 12, 2026, that a cybersecurity incident affected computer systems and limited services. Regular phone lines at two magistrate offices and the Historical Commission were unavailable, while emergency services and 911 dispatch remained operational. The county's live alert still listed those lines and the Clerk of Court juror-information lines as unavailable September 2.

The Douglas County Sheriff's Office in Kansas disconnected systems after identifying suspicious activity on August 11, 2026, disrupting inmate reports and fingerprint scheduling. Lawrence police remained disconnected from the shared Spillman network through September 3, limiting report access and records searches while dispatch and 911 continued. A same-day City of Eudora network security incident may be related, but officials have not confirmed a connection; ransomware and data exposure remain unresolved.

Brazosport College identified a cybersecurity incident affecting its network on August 10, 2026, and took academic, communications and student-record systems offline for phased restoration. D2L returned August 17, and most campus internet and Wi-Fi services were restored by August 20, but guest Wi-Fi remained unavailable. On August 26, the college required students whose passwords predated the incident to reset them, while Qilin's claim of internal data remained unverified.

Brown City officials said a cyberattack changed the IP address of Well No. 3 and stopped the municipal well from producing water for several hours before staff restored it. No actor, ransomware or data theft is established, but the cellular control-system change closely matches the late-July 2026 water-utility campaign.

LexisNexis took Nexis Diligence, Nexis Metabase API and Nexis Newsdesk offline after unusual activity was identified on vendor-managed servers. Diligence returned during the August 8-9 weekend with its content catalog still rebuilding, and the other two services were expected to return August 10 after testing. No later continuing service impairment tied to this incident was found by August 30, so the incident is presumed resolved even though the exact restoration time and data impact remain unknown.

Wake County stopped using ElectSure's election-worker training and registration platform after learning August 7 that a hacker had obtained a vendor password with read-only access to records for about 9,000 precinct workers. The county revoked that access and moved to a replacement process, ending the affected platform's operational role; voting machines, ballots, voter-registration records and vote-counting systems were not connected or affected. No continuing registration or training disruption was found by August 30, so the incident is presumed resolved even though the investigation may continue.

The Hamilton Township Municipal Utilities Authority said it identified a likely attempted cyberattack on August 5, isolated and removed the threat, and reported the event to the FBI. The New Jersey utility called the attempt unsuccessful and said drinking-water quality was not affected; DysruptionHub assesses that this may describe the absence of an intended or public-facing consequence rather than prove that no system was reached. The attack timing, affected systems, extent of access, operational effects beyond water quality and any data impact remain unresolved.

Malware compromised Suisun City's IT systems on August 7, 2026, disrupting 911 routing, dispatch, records, payments and municipal services. City Hall department closures and the Solano County dispatch workaround continued August 25, and the city extended a water-disconnection deadline to September 2 because of operational adjustments. On September 2, the city's website still warned that the incident had affected City Hall and public-safety services; encryption, data impact, payment and actor attribution remain unconfirmed.

The City of Lancaster, Ohio, took municipal computers offline after ransomware notifications on Aug. 6, 2026, warning of delays in card payments and other computer-based work. By Aug. 28, the city had restored about 90% of affected data and programs, but recovery remained incomplete and some material might not return for security reasons.

Coryell County reported a technology disruption affecting several systems August 6 while emergency and essential services continued. No continuing limitation surfaced over the next 25 days, and ordinary county service pages remained available, supporting presumed resolution.

Mitchell, South Dakota, shut down a limited network segment August 6, 2026, while investigating a potential cybersecurity incident; critical and emergency services remained operational. The mayor said the city and its online systems were fully operational by August 12. Storm later claimed the city on a leak site, but Mitchell has not confirmed ransomware, data theft or actor responsibility.

Washburn County shut down county technology August 6 after detecting malicious cyber activity, disrupting phones and other internet-dependent services. Phones and email were restored by August 14, and every department was functional September 2, but some employees, printers and programs remained affected; the incident also prevented delivery of the weekly jail-booking report through September 1. Recovery remained active, while ransomware, data exposure and actor attribution were unresolved.

Woodhaven Lakes last documented server, internet and facility workarounds August 12. Ordinary facility, member and payment information was available by August 31 with no later outage report, supporting presumed resolution while Play's claim remains unverified.

Ransomware disabled Coweta, Oklahoma, computers, files and administrative services beginning August 5, 2026, disrupting City Hall transactions, building permits and in-person card payments while 911 and off-site systems remained available. By August 18, day-to-day operations and utility-payment channels were normal; limited internal restoration and plain-text utility bills remained but were not expected to affect public services. No later public-service impact was found by August 30, so the incident is presumed resolved while technical recovery and the data review may continue.

Waukegan Township said its email system was compromised, disrupting regular access and prompting a warning about malicious messages. Restoration was underway August 5, and no later evidence supports a specific continuing impairment or wider shutdown. The bounded incident is presumed resolved, although the exact recovery date, access vector, data impact and technical scope remain unknown.

Beaver County employees lost access to behavioral-health patient files during a ransomware incident later disclosed Aug. 4. Current service information and the absence of a later access problem support presumed operational resolution, while data and payment consequences remain open.

A cyberattack disrupted systems and delayed gate operations at North Carolina Ports facilities in Wilmington, Morehead City and Charlotte beginning August 4, 2026. Normal gate schedules returned August 6, and by August 18 the authority's ordinary customer tools and operating pages were available without a continuing delay warning, supporting presumed resolution. NC Ports has not published a technical all-clear or confirmed ransomware, data compromise or attribution.

JPS Health Network took systems offline after identifying suspicious activity August 3, disrupting technology, communications, records processing and care workflows across its hospital and clinics. Its core electronic health record returned August 14, ending an ambulance diversion and restoring clinics, laboratories, pharmacies and elective procedures; MyChart followed and routine operations resumed August 16. JPS has not disclosed malicious or unauthorized activity, ransomware, data impact or a responsible actor.

Sawyer Savings Bank closed all four Ulster County branches after an August 3, 2026, network disruption that it later called a likely data security incident involving a vendor vulnerability, while digital banking remained available. The bank reopened all branches August 10 after affected systems were restored and tested, though its investigation into possible data impact continued. A separate Storm claim provides additional cyber evidence but does not establish ransomware, actor responsibility or data theft.

The City of Norcross identified a ransomware incident on Aug. 1, 2026, that affected certain municipal computer systems and caused limited service disruptions. Most systems and services were operational by Aug. 28, but restoration remained underway; the affected services, data impact, ransom activity and responsible actor were not disclosed.

Rapid City said it quickly detected and contained an attempted cyber intrusion involving a municipal wastewater lift station. Officials reported that water and wastewater infrastructure remained safe, drinking water was secure, and no operational disruption occurred while the city investigated with CISA and other federal partners.

A cyber incident disrupted Southeastern Oklahoma State University systems and closed its Durant campus July 30, July 31 and August 3, 2026, while restoration continued. Ordinary campus operations had resumed by August 18, supporting presumed resolution of the material disruption. Interlock claims it published 710 GB of university data, including records tied to more than 90,000 students, but the university has not confirmed the actor, ransomware or data theft.

A July 27 cyberattack affecting UIS SCADA infrastructure cut remote monitoring for Alpena Township's water and sewer operator and required programmable logic controllers at multiple sites to be reprogrammed. Remote monitoring was restored and utility service remained safe, while the township considered replacing 15 older cellular modems; the access method, data impact and actor remain unknown.

A malicious cyberattack disabled computerized operating controls at Braham's municipal water plant on July 27, 2026, stopping the well and treatment plant for about two hours before crews restored operations without affecting drinking-water quality. Braham was among more than 30 Minnesota water-system attacks, but public attribution remained unresolved despite reports that anonymously briefed officials suspected Iranian hackers.

A July 27, 2026, cyberattack blocked remote access to the City of Cape May Water and Sewer Department's monitoring system, requiring manual controls until normal operations resumed July 28. The city manager said attackers did not change operational settings or take control, and officials said water service, drinking-water safety and customer data were unaffected.

The utility kept water, sewer and gas service operating manually after the July 27 SCADA attack and expected security work to take about two weeks. That period passed without a later continuing limitation, so the incident is presumed resolved.

Intruders gained remote access to Coweta County Water and Sewerage Authority controls on July 27, 2026, changed passwords and disrupted automated control communication, prompting operators to switch to manual operation. Authority officials said water service, water quality and customer data were unaffected. No later operational impact was documented, and the incident is presumed resolved; the final automated-control restoration time and responsible actor remain unknown.

Clayton County Water Authority said unauthorized cyber activity may have caused or contributed to a July 27, 2026, disruption affecting operational systems and water service in north Clayton County. Water pressure was restored within hours, the precautionary boil-water advisory was lifted July 28 after negative water-quality tests, and CCWA said it found no evidence that customer billing or payment information was accessed or compromised.

Columbus Water Works detected and contained a cyberattack on July 27, 2026, affecting portions of its automated monitoring systems. Operators shifted to manual control, and officials reported no interruption to water service or drinking-water quality; the access method and responsible actor remain unknown.

A cybersecurity incident disrupted the Kenaitze Indian Tribe's computers, internet, email and phones beginning no later than July 27, limiting health, elder, education, transit and social services. The Tribe's website still described the technical outage as unresolved Sept. 11; The Gentlemen's claim remained unconfirmed as to responsibility, ransomware, encryption, data theft or a ransom demand.

A cybersecurity incident affected automated controls supporting Maple Plain's municipal water utility on July 27, 2026, but contingency procedures kept drinking water safe and water and wastewater services fully operational. Maple Plain was among more than 30 Minnesota water-system attacks; public attribution remained open despite reports that anonymously briefed officials suspected Iranian hackers.

Newton County Schools took affected systems offline after detecting unauthorized network activity, disrupting phones, email and other network services around the start of classes. The district said network services were restored August 6, although technicians were still validating remaining systems and applications. Qilin listed "Newton County School System" and the district's domain on its leak site August 28, but the claim remains unverified and does not establish encryption, data theft or actor responsibility.

South St. Paul identified malicious activity affecting automated water-utility controls on July 27, 2026, but contingency procedures kept drinking water safe and water and wastewater services operating normally. The incident was among more than 30 Minnesota water-system attacks; public attribution remained open despite reports that anonymously briefed officials suspected Iranian hackers.

A July 27, 2026, cyber intrusion disrupted phone communications with Woodbine, New Jersey's municipal water system and required employees to reactivate and operate the system manually. Officials said water service continued, drinking water remained safe, no customer data was compromised and the system returned online without further issues.

A ransomware incident beginning July 26, 2026, disrupted AnMed's network and patient care across South Carolina and Georgia. AnMed now says a virus locked access to network files, files were copied without permission and its network was securely restored; its review of potentially affected patient information continues. Victim-specific negotiation access supports medium-confidence Interlock attribution, but a conflicting Gentlemen claim remains unresolved.

A cyberattack disrupted cellular communications at two Plymouth water towers and several wastewater lift stations overnight July 26–27, 2026, but crews maintained operations manually without affecting water levels, quality, or public services. Plymouth restored all impacted communications connections July 28 and returned the system to normal operations; attribution remained unresolved.

A cyberattack disrupted work email, internet access, Google Drive and ClassLink applications at Oceanside Unified School District beginning July 24, 2026. By August 18, the district had opened schools and was publishing routine first-day and school-program updates, supporting presumed resolution of the material disruption. Officials have not published a technical all-clear or confirmed affected data, ransomware, extortion or attribution.

City of Dallas security systems detected a possible threat originating outside the municipal network on July 20, 2026, and automatically took three public websites offline. The sites returned after more than 15 hours, while officials reported no network intrusion or loss of city data and said essential emergency, payment and permitting services remained available.

Sumner County Schools discovered unauthorized network access July 20, 2026, disrupting registration and delaying the first day of school from August 4 to August 10. By August 18, the district's website reflected ordinary post-opening school activity, supporting presumed resolution of the material disruption. Officials have not published a technical all-clear or confirmed affected data, ransomware, extortion or attribution.

Malicious traffic disrupted Tidewater Telecom and Lincolnville Communications internet service across coastal Maine beginning July 19, 2026, leaving some connections unusable and significantly limiting Damariscotta Town Office services. The providers reported near-normal service July 21, and their status page subsequently showed customer internet operational with no recurrence through July 26.

Coca-Cola confirmed that ransomware caused unauthorized access, data theft and a temporary suspension of fairlife production in the United States. Most production resumed July 27 while restoration continued, and no later operational impact was documented by August 26. Anubis claimed it released engineering, production and HR material, but Coca-Cola has not verified the actor, alleged files, claimed encryption scope or one-terabyte volume.

The Town of Milford, New Hampshire, confirmed unauthorized activity affecting municipal computer systems after phone, internet, clerk, billing, payment and meeting disruptions began July 15, 2026. On July 22, several systems remained offline for analysis, backup processes were still in use, and officials said the cause and full extent had not been confirmed. No later public evidence documented continuing operational impact or provided an authoritative all-clear, so the incident is presumed resolved.

Oklahoma Manufacturing Alliance said ransomware activity targeted two employee computers and affected a limited portion of its local network on July 15, 2026. Staff isolated the systems and restored access through a separate secure network later that morning, while OMA said it found no evidence of data removal or compromised client records.

TruStage's July 11 cyberattack affected its primary technology environment and backup infrastructure, forcing a cloud rebuild. As of Sept. 10, claims, policy servicing and disbursement functions remained only partially available while restoration continued; TruStage expected most pre-incident Life and AD&D claims to be paid by mid-September. Data access, ransomware and attribution remained unresolved.

Virginia Peninsula Regional Jail discovered computer-system disruptions around July 14, 2026, determined it was a ransomware incident and later said operations had returned to normal without affecting facility safety or security. The jail said personal information may have been accessed or acquired, while INC Ransom separately claimed to have exfiltrated internal files; no misuse had been identified when the jail issued its notice.

A July 13 cyber incident disrupted Cedar Crest College applications, network drives, OneDrive and file sharing, with July 20 providing the last dated evidence of incomplete restoration. Required orientation and fall classes subsequently began without a located report of continuing material technology disruption, supporting presumed resolution while the exact recovery date remains unknown. The college has not confirmed data access or ransomware, and NightSpire's claim remains uncorroborated.

A large-scale distributed denial-of-service attack disrupted Greenfield Communications internet, television and phone service in Rancho Murieta and other California communities beginning July 12, 2026. Most customers were restored July 14, but IP-geolocation problems continued affecting streaming applications and some remote work through July 17.

Progress Software traced its July 2026 ShareFile Storage Zone Controller shutdown to a high-severity path traversal zero-day affecting all 5.x and 6.x versions and initially released versions 5.12.5 and 6.0.2. The containment action disrupted access to customer-managed files until July 14, but Progress said it had no indication of unauthorized access to customer accounts or data and had identified no active threat.

Greene County, Georgia, took its government network offline after identifying a cybersecurity incident July 9, 2026, disrupting payments and public-request processing while 911 and sheriff operations continued. By August 3, the county had removed its incident notice and the tax-payment application had returned to its normal verification gateway, with no later impact report found; operations are presumed resolved, while final forensic findings remain unpublished.

The St. Lucie County Clerk and Comptroller's externally hosted public website was compromised July 7, 2026, causing an hours-long homepage outage and redirecting some links to an unauthorized third-party site. Staff removed a malicious script and restored the site from a known-good backup; the clerk confirmed the compromise July 8, reported no evidence of access to internal systems or their data, and warned of possible slower performance during database re-indexing.

Pennington County identified a cybersecurity incident by July 5, 2026, closing most public-facing offices July 6 before staged reopening. Recovery remained incomplete August 31, when network service was still unavailable at some remote locations and the Wall Treasurer's satellite office was expected to remain closed throughout September. Some employees told not to report July 6 had to use accrued leave or take unpaid time because the county did not formally declare an emergency closure, and commissioners voted September 1 against making an exception; data impact, ransomware and attribution remain unresolved.

Jacksonville, Texas, detected suspicious network activity July 3, 2026, took affected municipal systems offline and used workarounds while some online services were unavailable. By August 3, the city website and payment services were operating, its alert center reported no active alerts and no later impact was found, so operations are presumed resolved. No final forensic, breach, ransomware or attribution update has been published.

Salida School District shut down its network after detecting a cyberattack June 29, 2026. Connected devices sustained file damage, some files could not be recovered and Central Office workflows were disrupted, while cloud services remained available. Later routine school communications support presumed operational resolution, but no technical all-clear or final forensic findings were published.

DCHA discovered a cybersecurity incident June 28, 2026, shut down its network and restored services in phases. It confirmed compromised sensitive information July 17 and announced normal operations for every department beginning July 20; no later disruption was found by August 3, so operations are presumed resolved. Interlock's ransomware and 1,660 GB theft claim remains unverified.

Delaware County, Pennsylvania, detected anomalous network activity June 26, 2026, and took its network offline after remote attackers accessed the network and county-maintained data, disrupting phones, servers, financial software, libraries and other public services. The county did not publicly acknowledge cyber involvement until July 2; an earlier Sheriff's Office explanation that called the outage a provider disruption was inconsistent with the county's later account of detecting and containing the intrusion June 26. The county restored operations using secure backups, while potential exposure of sensitive data remains under review.

American Color Imaging experienced a systems outage from June 24 to July 1, 2026, that paused production, held submitted orders, delayed customer communications and disabled an ordering platform. Settra publicly claimed on July 16 that it stole 653 GB of data, but ACI has not confirmed a cyberattack, unauthorized access, data theft or the actor's involvement.

Akron Public Schools detected and contained a June 23, 2026, cyber incident that caused a districtwide network outage and closed every district building June 24. Most programs, offices and athletics resumed June 25, but online credit recovery remained canceled through June 26 while external specialists investigated the incident's nature and scope.

The Wise County Sheriff's Office said hackers hit its systems twice during the week before June 22, 2026, preventing records retrieval and printing of incoming public-information requests. Logged and saved requests were lost or inaccessible and had to be rebuilt from sent email files. The deadline suspension ended July 5 and official request channels are currently available, but full restoration and recovery of missing requests remain unconfirmed.

University City, Missouri, confirmed that malicious cyber activity caused a network outage first publicized June 17, 2026, disrupting permitting, public-record access, card processing and online bill payment. On August 6, the city said affected systems and services had been restored and that its investigation found no evidence personal information was accessed, removed or compromised.

River Financial Corporation confirmed unauthorized access, ransomware deployment and removal of data from its network, including River Bank & Trust. A July 30 SEC amendment said River attempted to suppress the affected data and obtained the threat actor's representation that the stolen data was deleted. River did not say deletion was verified or disclose a ransom payment, and the affected information and potential materiality remain unresolved.

NAIC detected unauthorized access to its PeopleSoft environment on June 11, 2026, after exploitation of a zero-day vulnerability. Data was acquired and published, while suspended credit-rating feeds disrupted insurer investment designations and online invoice payments remained unavailable in the latest official update.

Prince George County, Virginia, said a June 11, 2026 cyber incident disrupted phones, internet and online payments before systems were secured and normal operations resumed. The county said personal data may have been accessed and offered identity monitoring, while RansomHouse's ransomware and attribution claims remain unverified.

Spartanburg County isolated portions of its network after detecting questionable activity on its computer infrastructure June 10, 2026, disrupting phones, courts, payments and records for nearly three weeks. Officials never publicly labeled the event a cybersecurity incident or confirmed malicious access, but the county's system-activity and security-response wording provides concrete cyber evidence under registry criteria. Core connectivity returned June 29, and operations are presumed resolved.

Onslow County Schools detected unauthorized criminal activity June 9, 2026, disrupting phones, internet, digital services, testing and graduation livestreams across the district. The district later said a relatively small portion of data was exfiltrated; by June 23 the attack was contained and major services were returning, but staged infrastructure restoration and the data-impact review remained underway.

The City of Acworth, Georgia, documented network outages and possible service interruptions June 8, 2026, then confirmed June 18 that a cybersecurity incident had affected certain computer systems and that all systems were restored. INC Ransom later claimed the city, alleged possession of municipal data and threatened release, but Acworth has not confirmed the actor, data theft, ransomware, a demand or payment.

Ransomware disrupted Evanston Township High School District 202 systems, phones, internet and safety functions beginning June 7, forcing a two-day campus closure and cancellations. The district documented limited systems and phased recovery through July 17, and the school opened for the 2026-27 year on August 17 without a newer report of a specific continuing operational disruption. Material impacts are presumed resolved, while payment, personal-information access and actor attribution remain unresolved.

Lewis Brisbois Bisgaard & Smith LLP restricted outside access to internal networks after a June 2026 cyberattack and directed remote and hybrid employees to work from offices or use firm-issued computers. The public record does not establish whether attackers successfully entered the network, accessed client or employee data, deployed ransomware, made an extortion demand or caused a client-service outage.

Kittson County reported a cyber incident involving its emergency-services network, prompting Minnesota IT Services to block the county’s access to state motor-vehicle systems as a precaution. Full DMV services were temporarily unavailable while limited tab payments and Department of Natural Resources transactions continued; emergency services remained operational, and ransomware, data theft and NightSpire attribution were unconfirmed.

Bowman Parks & Recreation disclosed at a June 2, 2026, city commission meeting that a cyberattack encrypted every department file and connected thumb-drive backups, making the records inaccessible. The files were later decrypted with outside expert assistance, but the attack date, initial access method, ransom or payment status, data-copying scope and public-facing service impact remain unresolved.

Nacogdoches County identified a phishing-related cybersecurity incident on May 28, 2026. Online pay-stub access was unavailable and paper stubs were in use July 1 while payroll and other county services continued; no newer operational-impact evidence was found by August 3, so the disruption is presumed resolved. A Texas AG listing reported 1,100 affected Texans.

Chelan County, Washington shut down government networks, computers and telephone systems after detecting malware on May 24, 2026. Email, phones, records access and other county functions remained disrupted for weeks, and the Clerk's Office later reported a backlog exceeding 6,000 documents as systems were restored.

Alexandria, Tennessee temporarily shut down Town Hall and police computers after fraudulent purchases were discovered in the town's Amazon account. The town later said only that account was affected and no public information was compromised or delayed; in June, aldermen approved five replacement computers and a managed-security service.

A cyberattack affected certain Commonwealth of the Northern Mariana Islands government email accounts on the cnmi.gov and dof.gov.mp domains, leaving some users without access. The Office of Information Technology initiated systemwide security protocols and corrective actions, but officials did not disclose the attack method, number of affected accounts, data impact, or final restoration date.

Delano Public Schools canceled classes May 20 after ransomware compromised its network; students returned the next day with limited connectivity. On June 10, the district said effects continued, old file folders were compromised through a firewall, and student and staff data was not compromised, narrowing an earlier statement that district data was likely stolen. LockBit claimed the attack and demanded $1.2 million, which the district said it did not pay.

The Scottsboro Police Department in Alabama said it detected and stopped an attempted cyberattack targeting department servers. Officials reported no evidence that police reports, photographs, videos, identifying information or other sensitive data were accessed, exported or compromised, and no service disruption was documented.

Chanhassen Dinner Theatres in Minnesota took systems offline after detecting a cyberattack on part of its network on May 15, 2026. Phone, computer and food-and-beverage systems were disrupted, and the attack came with a ransom note; performances were canceled or rescheduled before reopening May 21 on a temporary system. Current official ticketing information again lists normal payment and gift-card redemption options, supporting resolved status, while encryption, data theft, payment and attribution remain unconfirmed.

Krum Public Library confirmed that a May 14, 2026, ransomware attack disrupted computer access, printing and Wi-Fi and temporarily limited checkout to five items. The library later secured its network, and current official pages again advertise normal services; unauthorized file access was confirmed, while NightSpire's claim to have stolen 50 GB remains unverified.

Murray County, Georgia closed or limited several government offices after a ransomware attack disrupted county computer systems on May 13, 2026. County officials later said most systems had been restored and that the county paid $200,000 to prevent attackers from publishing county data, while 911, public safety, and voting remained available.

Boyne City, Michigan, experienced a cybersecurity incident May 11, 2026, that disrupted municipal computer access, email, utility billing, online payments and account-history functions. By July 31, online payments had returned and delayed billing had resumed, although staff were still restoring billing history and catching up on billing cycles; no later continuing service impact was found by August 30. The Gentlemen later claimed the city, but Boyne City has not confirmed the actor, ransomware or data theft.

Mountain Park, Oklahoma, identified unauthorized access to municipal systems on May 11, 2026, and requested assistance from the Oklahoma State Bureau of Investigation. The town said administrative email was disrupted, while emergency services and utility operations were not interrupted; the access method, responsible party and possible copying of municipal data remain unresolved.

Malicious code on Stack Sports' Sports Affinity checkout pages captured payment information entered from about May 8 until residual elements were cleared June 22, 2026. Stack Sports notified affected users after finalizing its transaction review July 17; the exposed fields may have included cardholder names, card numbers, expiration dates, CVVs and some checking-account numbers.

Allegany County Transit said a cybersecurity incident involving a third-party scheduling vendor required riders with May 6–7, 2026, pickups to call and confirm their trips. Public evidence points to IT Curves as the likely vendor, while Ababil of Minab separately claimed it compromised IT Curves and wiped and stole data; neither the vendor link nor the actor’s technical claims were confirmed.

West Pharmaceutical Services detected a cyberattack on May 4, 2026, in which an unauthorized party exfiltrated data and encrypted systems. The company took systems offline globally, disrupting manufacturing, shipping, receiving, and enterprise operations before reporting full operational restoration on May 20.

Exploitation of CVE-2026-41940 compromised Government of Guam web infrastructure and disrupted access to agency websites, downloads and public documents beginning in May 2026. The Bureau of Statistics and Plans later removed its restoration warning and repopulated report and data pages; the incident is presumed resolved because no territorial government all-clear establishes the exact recovery date.

A coordinated cyberattack forced the San Diego Community College District to shut down network systems, disrupting internet, Wi-Fi, websites, file servers, transcript processing, instruction and student services across San Diego City, Mesa, Miramar and Continuing Education colleges. Miramar directly confirmed the attack, while districtwide restoration proceeded by college and concluded with normal service status on May 15. The district said protected data was not compromised, and the public record does not establish ransomware or a threat actor.

DysruptionHub first reported Foxconn's multi-day Wisconsin network and production outage on May 5, 2026, before any other news publication identified in the reviewed chronology. Foxconn confirmed seven days later that a cyberattack affected some North American factories and said production was resuming, although workers at Mount Pleasant still described a slow, partial recovery. Nitrogen's claim of stealing approximately 8 TB of data remains unverified, and Foxconn has not identified every affected factory.

Kentwood Public Schools said a student used malicious software designed to disrupt its system, causing Wi-Fi connectivity problems throughout the Michigan district. Police investigated, outside experts helped isolate the issue, and the district said the technology problems appeared to have been resolved.

Instructure confirmed two related Canvas intrusions that exposed user, enrollment, course and message data and prompted a platform-wide outage May 7, 2026. Canvas returned to normal service, and the final incident-related Free-for-Teacher retrieval window ended July 29; continuing data review and notifications are breach-response activities rather than an ongoing service disruption.

Advanced Diagnostic Imaging, P.C., doing business as AdvancedHEALTH, said it detected suspicious activity on April 28, 2026 and determined that an unauthorized actor gained access to information on its systems. Columbia Surgical Partners had separately described ransomware at its parent and loss of EHR access. AdvancedHEALTH's June notice said its data review was ongoing and found no evidence of misuse; DragonForce's claimed 390 GB theft remains unverified.

Kent District Library disclosed a ransomware event after a computer outage beginning April 24, 2026 closed all 22 branches and disrupted public access to computers, printing and other services. Most services were restored by July 9, but KDL still reported limited printing and unavailable gaming labs while recovery work continued.

Harrison County, West Virginia, discovered ransomware-related computer disruptions around April 23, 2026, affecting courthouse services, tax payments and administrative functions while public-safety and election systems remained intact. Operations later returned to normal, but the county warned that personal information may have been accessed; SafePay claimed responsibility and data theft, but the county did not confirm the claim or resulting exposure.

Cherry Health experienced organizationwide technology issues in April 2026 that disrupted its phone system while clinics remained open. The provider later confirmed unauthorized access and copying of network data, and HHS listed the breach as a network-server hacking incident affecting 501 people.

A ransomware attack that Adams County officials said began April 17, 2026, disrupted county networks, digital court and public records, vehicle registration, and noncash payments while the sheriff's separate systems remained available. Most county IT was restored by early May, but vehicle-tag services were still unavailable on May 19; no ransom demand, data-theft finding, responsible actor or final restoration date was publicly established.

Tallahassee officials confirmed an April 17, 2026 cyberattack affecting parts of the city's technology environment, and the public website became unavailable that afternoon. City staff said they isolated the threat and initially found no operational impact, while Leon County disconnected a shared network link as a precaution and warned of possible outages in linked applications.

Maryland took the Department of Assessments and Taxation's statewide Real Property Search application offline after detecting suspicious server activity April 14, 2026, directing users to local assessment offices during the outage. The state restored and cleared the tool for public use April 27 after testing found no evidence of a broader compromise.

The City of Palouse, Washington restored its public website from a hosting-provider backup after officials said the site had been hacked. Some recently added content was missing and required re-entry, while the city reported that no sensitive data was involved.

The City of Anthony reported missing public records, inaccessible systems and wiped police devices after a change in administration, limiting normal municipal records work. DysruptionHub assesses with medium confidence that the incident involved insider activity and digital information destruction, although the public record does not establish who acted or whether the actions were authorized.

Clinton County, Iowa, took portions of its network and internet connectivity offline after monitoring detected unusual activity consistent with the early stages of an attempted internet intrusion. The county said the threat was contained, all critical systems and services were restored by April 16, 2026, and later forensic findings showed no county data was accessed or extracted and no systems or records were damaged.

Spring Lake Park Schools discovered on April 12, 2026 that an outside actor had accessed district systems and shut systems down to contain further access. Classes were canceled for two days, along with child care and community programs, while the district restored phones, building security, fire-protection and other safety-dependent technology.

Signature Healthcare detected suspicious network activity on April 6, 2026, and shifted affected Massachusetts operations to downtime procedures. Brockton Hospital diverted ambulances, chemotherapy appointments were canceled, pharmacies could not fill prescriptions and electronic records services were impaired before staged restoration concluded later in April.

The Standard-Examiner in Ogden and Daily Herald in Provo, both owned by Ogden Newspapers, reported significant production difficulties that disrupted Monday and Tuesday newspaper printing and delivery in early April 2026 while their digital editions remained available. Qilin later listed only the Standard-Examiner on May 2, but neither newspaper has confirmed ransomware, data theft or a connection between the claim and the shared printing disruption.

Winona County detected a second, distinct 2026 ransomware attack on April 7 after malicious activity began April 6, prompting a local emergency declaration, system isolation and Minnesota National Guard cyber assistance. DMV and vital-statistics services remained offline on April 10, the county reported secure restoration of its network and critical public systems by April 24, and it later confirmed that attackers released information acquired from the network.

A cyber incident at Minidoka Memorial Hospital in Rupert, Idaho, temporarily affected internal systems, limited imaging services and prompted transfers of some emergency patients, while the hospital and clinics continued treating patients. Full imaging access was restored by midnight April 19, 2026; a Blackwater leak-site claim alleging data theft remains unverified and was not confirmed by the hospital.

Karl Auto Group discovered on April 4, 2026, that an unauthorized third party had accessed business systems, disrupting phones and computers across its Iowa dealership operations. The company said files may have contained sensitive customer and employee information, while RansomHouse separately claimed Karl Chevrolet and alleged encryption; ransomware, exfiltration and a connection to that actor remain unconfirmed.

Chevin Fleet Solutions took affected U.S. and U.K. FleetWave environments offline after disclosing a cybersecurity incident on April 2, 2026, causing a major service outage for fleet-management customers. Missouri's state fleet system became unavailable and required phone workarounds, while Chevin later confirmed unauthorized access to customer databases containing operational and personal information.

Uplink documented a cybersecurity event that disrupted BAT-MINI alarm signaling and interactive services used by dealers and monitored accounts across the United States from April 2 to April 4, 2026. The M2M Services-owned brand restored all BAT-MINI services by April 4 but did not disclose the event’s cause, affected-account count, data impact or a responsible actor.

Belgrade School District in Montana confirmed that malware affected systems in its network after technology problems began in early April 2026. The incident disrupted routine school functions, including lunch processing and assignments, while restoration continued and the district reviewed whether student or staff information outside Infinite Campus was affected.

Gritman Medical Center described an electronic-systems outage that closed multiple outpatient clinics beginning April 1, 2026, while its hospital and emergency department remained open. Clinics reopened April 6, although four rural sites still had phone outages; the provider called the event a cybersecurity incident but reported no successful system access or known patient-data compromise in its preliminary findings.

A ransomware attack discovered March 31, 2026, directly affected the Patriot Regional Emergency Communications Center and the Town of Pepperell, disrupting Pepperell's network for about one week and non-emergency public-safety phone service across PRECC's five member towns. PRECC is a joint regional service administered day to day by Pepperell and governed by representatives of Ashby, Dunstable, Groton, Pepperell and Townsend; it is not a separate municipality. 911 and emergency response continued, and available evidence does not show that the other four towns' municipal networks were compromised.

Hasbro identified unauthorized access to its network on March 28, 2026, took certain systems offline and used business-continuity measures while restoring operations. The incident disrupted order processing, shipping and invoicing throughout the second quarter, with Hasbro estimating an approximately $25 million revenue impact before returning to pre-incident practices.

The City of Martinsville, Virginia, detected a cyberattack March 25, 2026, that disrupted computer systems and delayed or limited services in the municipal building. City Manager Robert Fincher said April 9 that city services were fully operational. A later city notice said personal information might have been accessed but reported no evidence of misuse.

Ransomware disabled the Jackson County Sheriff's Office network in Indiana in March 2026, leaving computers, Wi-Fi and the police-report system inaccessible. Dispatchers shifted to Seymour Police Department computers, officers wrote reports in Word documents and technicians rebuilt the environment while officials said the county would not pay a ransom.

North Attleborough Public Schools detected unauthorized network activity on March 25, 2026, and later shut down districtwide internet access as a precaution. The outage disrupted communications and limited classroom technology access, but instruction continued and officials said all network connectivity was restored by April 1.

Ransomware disrupted internet, Wi-Fi, Gmail and Google applications across Alamo Heights ISD from March 23 to March 27. The district later said personal information was accessed and potentially downloaded, affecting 26,629 people, and said no ransom was paid. WorldLeaks and Qilin posted separate victim listings, but the conflicting claims do not establish who caused the incident.

Puerto Rico security monitors detected and neutralized a cyberattack attempt against DTOP on March 23, prompting officials to disconnect systems and pause CESCO appointments across the territory. CESCO centers resumed regular operations March 26 except Utuado, which still required additional validation. Officials said resident information remained secure, and no stable public actor claim was identified.

The Town of Colebrook said a municipal email account was hacked, prompting New Hampshire to suspend state-system connections serving the Town Clerk's Office and dispatch. The disconnection interrupted vital-records, election and DMV access; vital records and election functions were restored by March 27, 2026, while DMV and dispatch reconnection remained pending.

Foster City found ransomware on municipal networks March 19 and shut down its network, pausing most non-emergency public services while 911 and police dispatch remained operational. Phone and email connectivity returned March 27, but virtual services were still being restored; on April 7, the city still lacked full network access despite restoring permitting and recreation registration. No stable public actor claim was identified.

An unauthorized actor accessed an Infinite Campus employee's Salesforce account March 18, 2026, prompting the company to disable some customer-facing services while investigating an extortion demand. ShinyHunters claimed the intrusion, and data associated with about 137,100 school-staff accounts was publicly released and indexed; Infinite Campus did not name the actor. The service disruption is presumed resolved, while data publication is confirmed.

Mile Bluff Medical Center disclosed an April 2026 security event involving data encryption that disrupted phone and computer functions and forced clinical teams to use downtime procedures while patient care continued. A later breach notice said an unauthorized actor had accessed the network from March 18 through April 19 and copied files, while the electronic health record was not affected.

San Felipe-Del Rio CISD detected suspicious email activity March 18 before internet, phones and other in-network communications and data systems went down. Schools, classes and transportation continued. WorldLeaks later listed the district, but the claim does not prove ransomware, data theft or actor responsibility; the incident is presumed resolved.

Clayton detected suspicious network activity on one system March 18 and manually took its network offline, limiting phones and online services during restoration. By March 23, investigators said attempted data access was unsuccessful and found no evidence that customer or employee data was compromised. No stable public actor claim was identified, and no later continuing impact was found.

Pro-Iran imagery and a Farsi control message replaced the Yeshiva World News homepage March 18, interrupting access to the outlet's website and articles before it displayed a maintenance page. The website later resumed normal publishing. No stable actor claim or evidence of ransomware or extortion has surfaced, leaving attribution unresolved.

CareCloud said an intruder accessed one of its six electronic health record environments from March 10 to March 16, 2026, disrupting functionality and data access for about eight hours before restoration. Forensic analysis confirmed data exfiltration, and breach filings showed at least 345,000 people across the United States were affected by theft of medical, identity and financial information. No stable public ransomware or extortion claim identifies a responsible actor.

LA Metro restricted internal administrative systems after detecting unauthorized activity March 16, disrupting arrival information and some TAP fare-loading channels while buses and trains continued operating. Ababil of Minab claimed the intrusion; later technical research found LA Metro data on infrastructure tied to the operation, supporting high-confidence attribution and data theft but not the actor's claimed destruction or exfiltration volumes. The incident is presumed resolved because no continuing operational impact has been documented since April 2.

A security incident prompted Lucas County to take systems offline in mid-March, disrupting the AREIS property-records portal and dog-licensing service. Public-facing systems were accessible again and AREIS was restored March 17, supporting resolved operational status, while the cause, data impact and actor remain undisclosed.

At Sage Water Resources' Duchesne, Utah, saltwater-disposal facility, an attacker altered PLC safety logic on March 15, 2026, bypassing shutdown protections and leaving pumps running dry while the control system showed normal operation. A truck driver spotted the mismatch; workers shut down automation, continued receiving wastewater under manual control, and avoided pump failure, service interruption and environmental harm. Sage said a contractor rebuilt and verified the safety logic and restored continuous operation within days.

A cyberattack disrupted network resources used by Goodwill Industries of Greater Grand Rapids at 18 stores across six western Michigan counties in March 2026, forcing cash-only sales while the nonprofit rebuilt its point-of-sale program. An Interlock listing contained material appearing to identify the regional affiliate despite an incorrect Pennsylvania label, but Goodwill did not confirm ransomware, data theft or attribution.

A March 14 cyberattack led Intoxalock to pause systems supporting installations, calibrations, account access and service centers across its nationwide network. Some drivers could not start their vehicles, and two named shops reported blocked work; Intoxalock said core services resumed March 22. State agencies addressed compliance consequences, but no agency outage was documented, and ransomware, attribution and data theft remain unconfirmed.

Minot officials said ransomware affected a Water Treatment Plant SCADA server March 14, 2026, prompting isolation and about 16 hours of manual monitoring before a backup restored local visibility. A connected Northwest Area Water Supply system returned to full operation March 17, but its data link with Minot remained disabled May 20 while water safety, pressure and customer service remained intact.

Ransomware disrupted the DeKalb County Sheriff's Department and jail server March 13, interrupting email and inmate booking. Booking data was recovered that evening, but the public record does not provide a full restoration date, identify the ransomware family or establish data theft.

Duffy’s Sports Grill experienced multi-day card-payment and MVP loyalty disruptions at multiple Florida restaurants beginning by March 13. Customer reports also described cash-only service, a manual card workaround, event cancellations and at least one temporary closure. Qilin’s March 14 listing remains a low-confidence attribution claim, and no later continuing impact was identified, so the incident is presumed resolved.

A March 2026 network intrusion disrupted Aroostook Mental Health Center connectivity and business operations across its service area in Aroostook, Hancock and Washington counties. Qilin claimed the organization on March 24, and AMHC later confirmed that an unauthorized actor accessed its network on March 11-12 and copied files containing personal information. The federal breach portal lists 501 affected people, while the Maine filing leaves the total undetermined.

Hanover County Public Schools lost divisionwide internet access and multiple systems after a malicious actor accessed network data and attempted to deploy ransomware in March 2026. Instruction continued without normal technology until internet and core platforms began returning March 18. HCPS said personal information may have been viewed or accessed, but it reported no indication of misuse and did not identify the actor.

A March 11 destructive cyberattack wiped about 40,000 Stryker laptops and disrupted its Microsoft environment, global manufacturing, order processing, shipping and some customer procedures. Handala claimed the attack; federal authorities later said an Iran intelligence ministry-controlled Handala domain was used to claim the operation, supporting high-confidence attribution, while the actor's 200,000-device and 50 TB theft assertions remain unverified. Stryker said its manufacturing, commercial, ordering and distribution systems were restored by April 9.

NewspaperArchive said an unauthorized third party remotely accessed and encrypted systems hosting its historical-newspaper platform in February 2026, making the service unavailable to libraries and subscribers. Core search and download functions returned during a phased recovery, but some publications and personal accounts remained unavailable as of May 19.

A cybersecurity incident affected portions of Rusk County’s network and led the county to engage forensic specialists while restoring safe, remediated systems. Qilin later claimed the March incident at low confidence because the county did not corroborate attribution; a Lynx listing concerned a separate November 2025 outage. The dated effects are older than 30 days with no continuing outage identified, supporting presumed-resolved status.

Belhaven University took portions of its internal network offline March 6 after identifying a cybersecurity incident. Some services remained unavailable March 18; most student services were operating normally and online classes were scheduled to resume March 19. No final all-clear was published, supporting presumed-resolved rather than resolved status.

Passaic County said a March 4 ransomware event made its network, phones, computers and internet inoperable, and the county later said most operations had been restored. Medusa claimed responsibility and threatened to publish data, but the county did not confirm the attribution or the scope of any data access.

Alcorn School District disabled its network March 1 after suspicious activity disrupted certain systems and threatened scheduled testing. LockBit later claimed the Mississippi district and demanded an undisclosed ransom, but the district did not confirm ransomware, actor responsibility, encryption or data theft. No later operational-impact notice or formal restoration statement was found, and the incident is presumed resolved.

A cyber-related IT disruption that LCCC said began February 27 closed all four sites March 4 and moved classes online. Campuses reopened in stages by March 23, but Wi-Fi and telephone effects continued into April. Medusa claimed LCCC on March 17, and a secondary tracker reported a $100,000 demand and alleged exfiltration, but the claim does not establish ransomware deployment, data theft or Medusa responsibility.

Attackers encrypted Peak Software Systems infrastructure, backups and internal systems supporting the Sportsman platform, disrupting municipal recreation registration, reservations, rentals and payments in at least six cities. Lehi City later said an unauthorized party accessed systems and that certain Legacy Center files may have been accessed or acquired. Services were restored, the incident was contained and no stable threat-actor claim was found.

Wagon Mound Public Schools said a virus shut down district internet and networked computers around February 26, 2026, while its insurer worked to restore systems and staff and student devices were collected for scanning. Interlock listed the district March 9 and claimed it obtained about 80 GB of staff and student information, but the district has not confirmed ransomware, the actor or data theft. March 3 remains the last dated evidence of disruption, supporting presumed-resolved status without establishing an exact recovery date.

Ohio County Schools disabled district internet after detecting evidence of a potential cybersecurity attack Feb. 24, disrupting connected learning and administrative work for nearly a week. The district reported full functionality March 2 and said it had no evidence that student or employee data was at risk; the mechanism and actor remain unresolved.

A ransomware attack struck the University of Mississippi Medical Center on Feb. 19, 2026, disabling Epic records, phone and email systems and closing 35 clinics across 23 Mississippi municipalities. Clinics and phone service returned March 2 after nine days, while Medusa later claimed the attack and demanded $800,000 to prevent publication of allegedly stolen data.

A technology outage closed Town Hall, Public Works and Community Development offices in Orange, Virginia, for parts of three days in February 2026 and temporarily limited Town Hall payments to cash or checks. LockBit listed `townoforangeva.gov` on its leak site March 5, providing concrete external cyber evidence but not proving that ransomware caused the outage, that data was stolen or that the town confirmed the claim.

Huntington, West Virginia, detected suspicious activity on February 17, 2026, and isolated municipal systems during a cybersecurity investigation. A limited number of internal systems were affected and normal operations returned February 19; Termite later claimed the city, but the listing remains uncorroborated.

Livingston HealthCare disclosed a potential cybersecurity incident on February 13, 2026, after phone and network services were disrupted and some systems were taken offline. Phones returned February 16, but staff still could not use the patient portal February 18; the final recovery date and possible patient-data compromise remain unresolved.

Meriden shut down its municipal network after discovering an attempted internet interruption Feb. 13, 2026, disrupting payments, records, meetings, library access and normal staff workflows for weeks. Online payments, hybrid meetings and emergency dispatch had returned by April 23, but the city had not issued a full all-clear; INCRansom's later claim remains unconfirmed.

Ransomware locked computer systems at the Virgin Islands Economic Development Authority by Feb. 12, 2026, and prompted a demand exceeding $300,000. Officials investigated whether beneficiary tax records were exposed; no actor, payment or confirmed data theft has been disclosed, and later board activity showed some operations had resumed without establishing an exact restoration date.

A cyberattack disrupted the State College Borough network Feb. 11, 2026, delaying email responses and closing the Centre Region Council of Governments building, which depended on borough IT services. Borough offices, phones and public-safety services remained available; the exact restoration date was not disclosed.

Cocoa experienced an IT disruption after an external-system breach spanning February 8-16, 2026, disrupting phones, payments and municipal workflows while emergency and water operations continued. The city initially described the event only as "technical issues," then notified 896 people of hacking June 4, 107 days after its first public operational disclosure and 101 days after INCRansom claimed the city. The claim remains unconfirmed, and some system restoration was still underway March 10.

A Pinellas County arrest affidavit alleges that a former Clearwater Public Library System technology employee used a library administrative account on February 5, 2026, to remove Deep Freeze security software from about 200 public computers. The action led the city to shut down patron computers at three Florida library branches, while the accused employee pleaded not guilty and no theft, fraud or misuse of personal information was alleged.

Denmark School District lost internet across its facilities for five school days beginning January 30, requiring paper-based instruction and administrative workarounds. The district later acknowledged a potential data security incident; teachers said at least 60 current and former employees were affected and alleged that the district received a ransom note, while INC Ransom separately claimed encryption and theft of about 71 GB. The district did not corroborate the actor's claims or link reported employee tax fraud to the incident, and the documented internet disruption ended February 5.

A security incident affecting CloudCone's Budget VPS platform in Los Angeles executed an unauthorized management-layer script, displayed ransom messages and made affected virtual-server disks irrecoverable. CloudCone restored the affected platform Feb. 11, 2026; other regions and service platforms were not affected.

A ransomware attack disrupted New Britain municipal systems beginning Jan. 28, 2026, forcing manual workarounds while police and fire services remained operational. The city later said limited unauthorized activity may have exposed sensitive personal information.

Winona County detected ransomware on January 22, 2026, after unauthorized network access began January 18, disrupting phone lines, internal systems, records access and other county services. Some systems remained offline on February 12. The county later confirmed data theft affecting 6,196 people and disclosed a negotiated $128,539.57 payment, made with assistance from its insurer to restore services and protect personal information.

The Town of Edisto Beach disclosed a potential cybersecurity incident involving email on Jan. 22, 2026. The town later said the event was an isolated cyber fraud scheme that caused an undisclosed financial loss, nearly 89% of which was recovered, with no resident or customer information compromised.

Ransomware encrypted Community College of Beaver County systems March 9, closing the main campus and disrupting classes, account access and academic and financial records. CCBC later said an unauthorized party accessed its systems from January 16 through March 9 and obtained information that may have included names, Social Security and passport numbers, and financial account information with credentials. The college returned to full operational status March 30; Interlock's separate claim of responsibility and 780 GB of stolen data remains uncorroborated.

Midway, Florida, officials confirmed ransomware involving the police department’s SmartCOP records system in January 2026. The incident disrupted access to records and delayed public-records requests while investigators assessed possible data impact.

Anchorage Police Department shut down certain servers and disabled vendor access after learning Jan. 7, 2026, that a software provider involved in an upgrade had been attacked. APD found no evidence its systems were compromised or its data acquired.

Beacon Mutual detected unauthorized access Jan. 14, 2026, disconnected systems and restored production Jan. 20. The company later confirmed that files containing Social Security numbers and other sensitive information were copied; INC Ransom separately claimed responsibility and 275 GB of data.

Ransomware disrupted Metro Pet Vet and Manheim Pike Veterinary Hospital in Lancaster County, Pennsylvania, in January 2026, blocking access to a shared server and patient records at three clinics. Staff used paper records and a scheduling app while continuing urgent and scheduled care; data access or theft and the threat actor remain unresolved.

Milton, Florida, detected suspicious activity consistent with ransomware on December 26, 2025, and secured its network. Utility billing, automatic payments and online payment services were disrupted into spring 2026, while investigators reported no evidence that city information was taken.

Snyderville Basin Water Reclamation District said monitoring detected an intruder encrypting files on an ArcGIS server in December 2025. The district isolated the server and recovered the files; it tentatively associated the event with China and Flax Typhoon, but the attribution and ransomware theory remain unconfirmed.

A ransomware attack beginning Dec. 8, 2025, disrupted computers, email, phones, schools and tribal operations for the Cheyenne and Arapaho Tribes in Oklahoma. Rhysida claimed the attack in February 2026, demanded 10 bitcoin and alleged data theft, while the tribe said it paid nothing.

Northwest Iowa Community College experienced a computer network disruption in late November and early December 2025 that canceled on-campus classes and impaired campus technology services. The college later confirmed unauthorized activity and said information may have been accessed or downloaded between November 24 and November 26, 2025. Its July 2026 breach filing identified 16,004 Iowa residents whose names and Social Security numbers were potentially affected.

Geauga County blocked Russell Township Police Department's email domain on September 8, 2025, after security alerts tied to a police mobile data terminal and school resource officer laptop. The department lost email and full workstation access to Spillman, forcing alternate and hand-delivery workarounds until a government domain became operational November 6, while whether either device was actually compromised remains unresolved.

Unauthorized activity in Bellflower Unified School District's network disrupted internet, phone, and on-premises services in August 2025 while staff rebuilt the environment. A later district breach notice said personal information may have been accessed, while Rhysida's claim and alleged data publication remain unconfirmed attribution rather than official ransomware confirmation.

A ransomware incident that began on July 8, 2025 disrupted City of York email, computers and parking-garage kiosks for weeks. The city's insurer reportedly negotiated a $1 million demand to $500,000 and paid it, and York later confirmed that an unknown actor accessed its network and accessed or acquired files.

A former Saydel Community School District IT employee used retained credentials from at least May 14, 2023, through January 2025 to access district systems and disrupt accounts, classroom platforms and managed devices. Ezekiel Dean Potter pleaded guilty to computer fraud and was sentenced June 11, 2026, to 21 months in prison and $59,668.81 in restitution.