Cyber Incident Registry

The City of Fort Smith said an Aug. 16, 2026, network security event disrupted certain computer systems and city services. The city said 911 dispatch and emergency response remained fully functional while it worked with federal law enforcement and cybersecurity specialists to restore services.

UT San Antonio took some academic-campus systems and services offline after detecting attempted unauthorized activity at the edge of its network during the weekend of August 15-16. The response made the university website, accounts, registration and payment services unavailable and disrupted waitlists and phones immediately before fall classes. The university said the activity did not reach core systems and that it had found no evidence of data access or exfiltration.

The Town of Lincoln, Maine, said its IT provider found encrypted files on portions of the municipal network after activity that may have begun August 13. The town isolated affected systems, closed the town office on August 17 and directed residents seeking registrations, licenses or vital records to state online services. No threat actor, ransom demand or data-theft claim had been identified publicly.

Namecheap services and customer websites worldwide went offline August 13 during a cooling-system failure at its Phoenix data center. An early Namecheap status notice reportedly attributed separate Private Email and Jellyfish disruption to a DDoS attack, but the broad outage and staged restoration were tied to unsafe temperatures; full service was reported restored August 14.

Plymouth County Correctional Facility shut down its computer system after detecting unauthorized server access on August 13, suspending in-person visits because staff could not retrieve visitor-clearance records. Attorney visits and incarcerated people's tablet and phone access continued, while state police, the FBI and the Department of Homeland Security investigated. The public record does not establish ransomware, extortion, a threat actor or whether information was acquired.

Darlington County said Aug. 12, 2026, that a cybersecurity incident affected computer systems and limited services. Phone lines at two magistrate offices and the Historical Commission were unavailable, while emergency services and 911 dispatch remained operational.

Brazosport College identified a cybersecurity incident affecting its network Aug. 10, 2026, and kept key academic, communications and student-record systems offline while restoring them in phases. The disruption extended summer deadlines, limited registration, advising and financial-aid services, delayed payments and pushed Fall and Fall I classes back one week; four days after detection, the college said it had no indication student, faculty or staff information was accessed or acquired, but the investigation and recovery remained ongoing.

LexisNexis took Nexis Diligence, Nexis Metabase API and Nexis Newsdesk offline after identifying unusual activity on servers hosted and managed by an unnamed third-party vendor. The company disconnected the systems, engaged a cybersecurity forensic firm and began rebuilding the applications in a new environment, but it did not confirm unauthorized access, data exposure, ransomware or a threat actor.

Wake County stopped using ElectSure’s election-worker training and registration platform after learning Aug. 7 that a hacker had obtained a vendor password. The vendor had read-only access to records for about 9,000 precinct workers, but officials had found no evidence that names, email addresses, training or assignment information were acquired. Voting machines, ballots, voter-registration records and vote-counting systems were not connected to the platform or affected.

Mitchell, South Dakota, shut down a limited network segment August 7, 2026, while investigating what the mayor called a potential cybersecurity incident and working with forensic specialists. A county warning had described city email service as hacked, but the mayor said there was no indication the city's email environment was affected; critical and emergency services remained operational.

Suisun City said malicious software compromised municipal IT systems on August 7, 2026, prompting a shutdown of the city's entire IT network. As of August 10, dispatchers still handled 911 and nonemergency calls through Solano County, City Hall was closed for the day, several services were delayed and restoration remained underway.

Coryell County, Texas, reported on August 6, 2026, that a recent technology disruption affected several county systems while emergency and essential public-safety services remained fully operational. The county was restoring systems and investigating the event, but it had not disclosed the cause, identified a cyberattack or ransomware, reported a data impact, or issued an all-clear.

Washburn County, Wisconsin, shut down county technology on August 6, 2026, while responding to a cyber incident that disrupted phone, email and internet-dependent services. The county said email and phone systems were operating again by August 14, but restoration of other programs and services remained underway.

Woodhaven Lakes said ransomware began encrypting files on August 6 before the attack was stopped within hours. The General Store restored card payments by August 8, but ongoing network maintenance kept Woody's Service Center closed through August 9; the latest post did not provide a full all-clear for phones, internet, RecPlex payments or broader restoration.

Coweta, Oklahoma, experienced a systemwide ransomware attack on August 5, 2026, that took city computers, files and computer-based services offline and stopped City Hall transactions, building permits and in-person card payments. Emergency services, 911, off-site police and fire systems, the city website and third-party online bill payment remained available while specialists secured and restored the city's systems.

Waukegan Township said its email system was compromised, disrupting regular access and prompting officials to warn residents about malicious messages appearing to come from the township. Officials were restoring email access on August 5, 2026, while the public record left the access vector, affected-account count, data impact, ransomware involvement and threat actor unresolved.

Attackers stole and encrypted sensitive information in Beaver County, Pennsylvania, systems used by Behavioral Health and Developmental Services, leaving employees unable to access patient files. County commissioners paid a reported $175,000 ransom in cryptocurrency in August 2026, but the attack date and threat actor remain unknown.

North Carolina Ports said all three facilities would return to normal gate schedules on August 6, 2026, but its IT team was still assessing affected systems, restoring services and warning of delays after an August 4 cyber incident. By August 10, the systems-issue alert was no longer displayed and normal customer tools were available, but the authority had not published an incident-specific technical all-clear.

JPS Health Network took systems offline after identifying suspicious activity August 3, disrupting technology, communications, records processing and care workflows across its hospital and clinics. Its core electronic health record returned August 14, ending an ambulance diversion and restoring clinics, laboratories, pharmacies and elective procedures; MyChart followed and routine operations resumed August 16. JPS has not disclosed malicious or unauthorized activity, ransomware, data impact or a responsible actor.

Sawyer Savings Bank closed all four Ulster County branches after an August 3, 2026, network disruption that it later called a likely data security incident involving a vendor vulnerability, while digital banking remained available. The bank reopened all branches August 10 after affected systems were restored and tested, though its investigation into possible data impact continued. A separate Storm claim provides additional cyber evidence but does not establish ransomware, actor responsibility or data theft.

Rapid City said it quickly detected and contained an attempted cyber intrusion involving a municipal wastewater lift station. Officials reported that water and wastewater infrastructure remained safe, drinking water was secure, and no operational disruption occurred while the city investigated with CISA and other federal partners.

Southeastern Oklahoma State University closed its Durant campus on July 30, July 31 and August 3 while restoring systems after a service disruption. KXII said campus was expected to reopen August 4 and continued to call the event a cybersecurity incident, while the university's own notices did not use cyber terminology. No incident-specific notice identified by August 10 confirmed reopening or full technical restoration.

A malicious cyberattack disabled computerized operating controls at Braham's municipal water plant on July 27, 2026, stopping the well and treatment plant for about two hours before crews restored operations without affecting drinking-water quality. Braham was among more than 30 Minnesota water-system attacks, but public attribution remained unresolved despite reports that anonymously briefed officials suspected Iranian hackers.

A July 27, 2026, cyberattack blocked remote access to the City of Cape May Water and Sewer Department's monitoring system, requiring manual controls until normal operations resumed July 28. The city manager said attackers did not change operational settings or take control, and officials said water service, drinking-water safety and customer data were unaffected.

A July 27, 2026, cyberattack targeted a programmable logic controller in Childersburg Water Works, Sewer, and Gas Board's SCADA environment, prompting the Alabama utility to take automated controls offline. Staff continued manual operations without interrupting water service or endangering the public supply, while security work was expected to keep SCADA offline for about two weeks.

Attackers gained remote access to Coweta County Water and Sewerage Authority controls on July 27, 2026, changed passwords and shut down automated controls, prompting operators to switch to manual operation. Authority officials said water service, water quality and customer data were unaffected while passwords were reset and an investigation continued.

Clayton County Water Authority said unauthorized cyber activity may have caused or contributed to a July 27, 2026, disruption affecting operational systems and water service in north Clayton County. Water pressure was restored within hours, the precautionary boil-water advisory was lifted July 28 after negative water-quality tests, and CCWA said it found no evidence that customer billing or payment information was accessed or compromised.

Columbus Water Works detected and contained a cyberattack on July 27, 2026, affecting portions of its automated monitoring systems. Operators shifted to manual control, and officials reported no interruption to water service or drinking-water quality; the access method and responsible actor remain unknown.

A cybersecurity incident disrupted the Kenaitze Indian Tribe's computers, internet, email and phones beginning no later than July 27, 2026, forcing temporary phone lines and limits on health, elder, education, transit and social services. The Tribe's official site still described restoration as ongoing on August 10; a tracker linked The Gentlemen to the incident, but the Tribe had not confirmed ransomware, data theft or a ransom demand.

A cybersecurity incident affected automated controls supporting Maple Plain's municipal water utility on July 27, 2026, but contingency procedures kept drinking water safe and water and wastewater services fully operational. Maple Plain was among more than 30 Minnesota water-system attacks; public attribution remained open despite reports that anonymously briefed officials suspected Iranian hackers.

Newton County Schools took affected systems offline after detecting unauthorized network activity, disrupting phones, email and other network services around the start of classes. The district reported continuing restoration work August 4 and said August 6 that network services had been restored, although technicians were still validating and fine-tuning remaining systems and applications.

South St. Paul identified malicious activity affecting automated water-utility controls on July 27, 2026, but contingency procedures kept drinking water safe and water and wastewater services operating normally. The incident was among more than 30 Minnesota water-system attacks; public attribution remained open despite reports that anonymously briefed officials suspected Iranian hackers.

A July 27, 2026, cyber intrusion disrupted phone communications with Woodbine, New Jersey's municipal water system and required employees to reactivate and operate the system manually. Officials said water service continued, drinking water remained safe, no customer data was compromised and the system returned online without further issues.

AnMed experienced a ransomware incident beginning July 26, 2026, that disrupted its network, phones, internet access, electronic records and patient care across South Carolina and Georgia. Facilities closed, procedures were delayed and staff used downtime workflows; records, direct phones and limited MyChart access returned by August 12, but some services and portal functions remained unavailable August 14. Victim-specific Interlock negotiation access supports medium-confidence attribution, although a Gentlemen-branded claim remains unverified by AnMed.

A cyberattack disrupted cellular communications at two Plymouth water towers and several wastewater lift stations overnight July 26–27, 2026, but crews maintained operations manually without affecting water levels, quality, or public services. Plymouth restored all impacted communications connections July 28 and returned the system to normal operations; attribution remained unresolved.

Oceanside Unified School District reported a computer network disruption that made work email, internet access, Google Drive and ClassLink applications unavailable while forensic specialists investigated. Credible local reporting characterized the event as a cyberattack beginning July 24, 2026, but the district had not publicly identified the cause, confirmed data access or provided a restoration timeline by July 31.

City of Dallas security systems detected a possible threat originating outside the municipal network on July 20, 2026, and automatically took three public websites offline. The sites returned after more than 15 hours, while officials reported no network intrusion or loss of city data and said essential emergency, payment and permitting services remained available.

Sumner County Schools discovered unauthorized network access July 20, 2026, disrupting registration and delaying the first day of school from August 4 to August 10. The revised calendar documented no school through August 7 and an August 10 opening, but officials have not published a completed recovery or forensic conclusion or confirmed affected data, ransomware, extortion or attribution.

Malicious traffic disrupted Tidewater Telecom and Lincolnville Communications internet service across coastal Maine beginning July 19, 2026, leaving some connections unusable and significantly limiting Damariscotta Town Office services. The providers reported near-normal service July 21, and their status page subsequently showed customer internet operational with no recurrence through July 26.

Coca-Cola confirmed that ransomware caused unauthorized access, data theft and a temporary suspension of fairlife's U.S. production; most production resumed July 27 while restoration continued. Anubis later claimed it released engineering, production and HR material, but Coca-Cola has not verified the actor, the alleged files, the claimed encryption scope or the one-terabyte volume.

The Town of Milford, New Hampshire, confirmed unauthorized activity affecting municipal computer systems after phone, internet, clerk, billing, payment and meeting disruptions began July 15, 2026. On July 22, several systems remained offline for analysis, backup processes were still in use, and officials said the cause and full extent had not been confirmed.

Oklahoma Manufacturing Alliance said ransomware activity targeted two employee computers and affected a limited portion of its local network on July 15, 2026. Staff isolated the systems and restored access through a separate secure network later that morning, while OMA said it found no evidence of data removal or compromised client records.

TruStage remained in active recovery August 18 after a July 11 cyberattack required parts of its infrastructure to be rebuilt. The company established a clean, isolated environment and restored some contact-center, claims, billing and retirement functions, but official guidance still documented limited claims, payments, account access and policy servicing, an unavailable BenefitsForYou platform, temporary processes and a backlog. Data access, ransomware and actor attribution remain unresolved.

Cedar Crest College's live incident page still described active investigation and secure restoration on August 10, with no timetable for every affected service and support available for continuing access problems. Campus applications, network drives, OneDrive and file sharing had been disrupted. The college has not confirmed data access or ransomware, and NightSpire's claim remains uncorroborated.

A large-scale distributed denial-of-service attack disrupted Greenfield Communications internet, television and phone service in Rancho Murieta and other California communities beginning July 12, 2026. Most customers were restored July 14, but IP-geolocation problems continued affecting streaming applications and some remote work through July 17.

Progress Software traced its July 2026 ShareFile Storage Zone Controller shutdown to a high-severity path traversal zero-day affecting all 5.x and 6.x versions and initially released versions 5.12.5 and 6.0.2. The containment action disrupted access to customer-managed files until July 14, but Progress said it had no indication of unauthorized access to customer accounts or data and had identified no active threat.

Greene County, Georgia, took its government network offline after identifying a cybersecurity incident July 9, 2026, disrupting payments and public-request processing while 911 and sheriff operations continued. By August 3, the county had removed its incident notice and the tax-payment application had returned to its normal verification gateway, with no later impact report found; operations are presumed resolved, while final forensic findings remain unpublished.

The St. Lucie County Clerk and Comptroller's externally hosted public website was compromised July 7, 2026, causing an hours-long homepage outage and redirecting some links to an unauthorized third-party site. Staff removed a malicious script and restored the site from a known-good backup; the clerk confirmed the compromise July 8, reported no evidence of access to internal systems or their data, and warned of possible slower performance during database re-indexing.

Pennington County identified a cybersecurity incident by July 5, 2026, closing most public-facing offices July 6 before staged reopening. Several services had resumed by July 27, but county email, lien payments, real-estate recording, vehicle-processing capacity and other workflows remained limited. The county homepage still warned of limited services August 10; data impact, ransomware and attribution remain unresolved.

Jacksonville, Texas, detected suspicious network activity July 3, 2026, took affected municipal systems offline and used workarounds while some online services were unavailable. By August 3, the city website and payment services were operating, its alert center reported no active alerts and no later impact was found, so operations are presumed resolved. No final forensic, breach, ransomware or attribution update has been published.

DCHA discovered a cybersecurity incident June 28, 2026, shut down its network and restored services in phases. It confirmed compromised sensitive information July 17 and announced normal operations for every department beginning July 20; no later disruption was found by August 3, so operations are presumed resolved. Interlock's ransomware and 1,660 GB theft claim remains unverified.

Delaware County, Pennsylvania, identified unauthorized intrusion attempts on June 26, 2026, and shut down network systems to protect sensitive information. Attackers gained limited access to the county network and data, while phones, servers, financial software, libraries and other public services were disrupted. The county removed its network-outage banner by August 10, but had not issued a final incident-specific restoration or investigative notice.

American Color Imaging experienced a systems outage from June 24 to July 1, 2026, that paused production, held submitted orders, delayed customer communications and disabled an ordering platform. Settra publicly claimed on July 16 that it stole 653 GB of data, but ACI has not confirmed a cyberattack, unauthorized access, data theft or the actor's involvement.

Akron Public Schools detected and contained a June 23, 2026, cyber incident that caused a districtwide network outage and closed every district building June 24. Most programs, offices and athletics resumed June 25, but online credit recovery remained canceled through June 26 while external specialists investigated the incident's nature and scope.

The Wise County Sheriff's Office said hackers hit its systems twice during the week before June 22, 2026, preventing records retrieval and printing of incoming public-information requests. Logged and saved requests were lost or inaccessible and had to be rebuilt from sent email files. The deadline suspension ended July 5 and official request channels are currently available, but full restoration and recovery of missing requests remain unconfirmed.

University City, Missouri, confirmed that malicious cyber activity caused a network outage first publicized June 17, 2026, disrupting permitting, public-record access, card processing and online bill payment. On August 6, the city said affected systems and services had been restored and that its investigation found no evidence personal information was accessed, removed or compromised.

River Financial Corporation confirmed unauthorized access, ransomware deployment and removal of data from its network, including River Bank & Trust. A July 30 SEC amendment said River attempted to suppress the affected data and obtained the threat actor's representation that the stolen data was deleted. River did not say deletion was verified or disclose a ransom payment, and the affected information and potential materiality remain unresolved.

NAIC detected unauthorized access to its PeopleSoft environment on June 11, 2026, after exploitation of a zero-day vulnerability. Data was acquired and published, while suspended credit-rating feeds disrupted insurer investment designations and online invoice payments remained unavailable in the latest official update.

Prince George County, Virginia, said a June 11, 2026 cyber incident disrupted phones, internet and online payments before systems were secured and normal operations resumed. The county said personal data may have been accessed and offered identity monitoring, while RansomHouse's ransomware and attribution claims remain unverified.

Spartanburg County isolated portions of its network after detecting questionable activity around June 10, 2026, causing weeks of disruption to phones, courts, payments, records and other services. That affected-organization wording provides concrete cyber-specific evidence, but officials did not confirm malicious access, malware, ransomware, data compromise or an actor. Core connectivity returned June 29, and operations are presumed resolved.

Onslow County Schools detected unauthorized criminal activity June 9, 2026, disrupting phones, internet, digital services, testing and graduation livestreams across the district. The district later said a relatively small portion of data was exfiltrated; by June 23 the attack was contained and major services were returning, but staged infrastructure restoration and the data-impact review remained underway.

The City of Acworth, Georgia, documented network outages and possible service interruptions June 8, 2026, then confirmed June 18 that a cybersecurity incident had affected certain computer systems and that all systems were restored. INC Ransom later claimed the city, alleged possession of municipal data and threatened release, but Acworth has not confirmed the actor, data theft, ransomware, a demand or payment.

Ransomware disrupted Evanston Township High School District 202 systems, phones, internet and safety functions beginning June 7, forcing a two-day campus closure and cancellations. The district documented limited systems and phased recovery through July 17, and the school opened for the 2026-27 year on August 17 without a newer report of a specific continuing operational disruption. Material impacts are presumed resolved, while payment, personal-information access and actor attribution remain unresolved.

Lewis Brisbois Bisgaard & Smith LLP restricted outside access to internal networks after a June 2026 cyberattack and directed remote and hybrid employees to work from offices or use firm-issued computers. The public record does not establish whether attackers successfully entered the network, accessed client or employee data, deployed ransomware, made an extortion demand or caused a client-service outage.

Kittson County reported a cyber incident involving its emergency-services network, prompting Minnesota IT Services to block the county’s access to state motor-vehicle systems as a precaution. Full DMV services were temporarily unavailable while limited tab payments and Department of Natural Resources transactions continued; emergency services remained operational, and ransomware, data theft and NightSpire attribution were unconfirmed.

Bowman Parks & Recreation disclosed at a June 2, 2026, city commission meeting that a cyberattack encrypted every department file and connected thumb-drive backups, making the records inaccessible. The files were later decrypted with outside expert assistance, but the attack date, initial access method, ransom or payment status, data-copying scope and public-facing service impact remain unresolved.

Nacogdoches County identified a phishing-related cybersecurity incident on May 28, 2026. Online pay-stub access was unavailable and paper stubs were in use July 1 while payroll and other county services continued; no newer operational-impact evidence was found by August 3, so the disruption is presumed resolved. A Texas AG listing reported 1,100 affected Texans.

Chelan County, Washington shut down government networks, computers and telephone systems after detecting malware on May 24, 2026. Email, phones, records access and other county functions remained disrupted for weeks, and the Clerk's Office later reported a backlog exceeding 6,000 documents as systems were restored.

Alexandria, Tennessee temporarily shut down Town Hall and police computers after fraudulent purchases were discovered in the town's Amazon account. The town later said only that account was affected and no public information was compromised or delayed; in June, aldermen approved five replacement computers and a managed-security service.

A cyberattack affected certain Commonwealth of the Northern Mariana Islands government email accounts on the cnmi.gov and dof.gov.mp domains, leaving some users without access. The Office of Information Technology initiated systemwide security protocols and corrective actions, but officials did not disclose the attack method, number of affected accounts, data impact, or final restoration date.

Delano Public Schools canceled classes May 20 after ransomware compromised its network; students returned the next day with limited connectivity. On June 10, the district said effects continued, old file folders were compromised through a firewall, and student and staff data was not compromised, narrowing an earlier statement that district data was likely stolen. LockBit claimed the attack and demanded $1.2 million, which the district said it did not pay.

The Scottsboro Police Department in Alabama said it detected and stopped an attempted cyberattack targeting department servers. Officials reported no evidence that police reports, photographs, videos, identifying information or other sensitive data were accessed, exported or compromised, and no service disruption was documented.

Chanhassen Dinner Theatres in Minnesota took systems offline after detecting a cyberattack on part of its network on May 15, 2026. Phone, computer and food-and-beverage systems were disrupted, and the attack came with a ransom note; performances were canceled or rescheduled before reopening May 21 on a temporary system. Current official ticketing information again lists normal payment and gift-card redemption options, supporting resolved status, while encryption, data theft, payment and attribution remain unconfirmed.

Krum Public Library confirmed that a May 14, 2026, ransomware attack disrupted computer access, printing and Wi-Fi and temporarily limited checkout to five items. The library later secured its network, and current official pages again advertise normal services; unauthorized file access was confirmed, while NightSpire's claim to have stolen 50 GB remains unverified.

Murray County, Georgia closed or limited several government offices after a ransomware attack disrupted county computer systems on May 13, 2026. County officials later said most systems had been restored and that the county paid $200,000 to prevent attackers from publishing county data, while 911, public safety, and voting remained available.

Boyne City, Michigan experienced a cybersecurity incident on May 11, 2026, that disrupted municipal computer access, email, utility billing, online payments, and account-history functions. The city restored its online payment portal and resumed delayed billing by late July, while TheGentlemen later claimed the city on a ransomware leak site without official confirmation of attribution or data theft.

Mountain Park, Oklahoma, identified unauthorized access to municipal systems on May 11, 2026, and requested assistance from the Oklahoma State Bureau of Investigation. The town said administrative email was disrupted, while emergency services and utility operations were not interrupted; the access method, responsible party and possible copying of municipal data remain unresolved.

Malicious code on Stack Sports' Sports Affinity checkout pages captured payment information entered from about May 8 until residual elements were cleared June 22, 2026. Stack Sports notified affected users after finalizing its transaction review July 17; the exposed fields may have included cardholder names, card numbers, expiration dates, CVVs and some checking-account numbers.

Allegany County Transit said a cybersecurity incident involving a third-party scheduling vendor required riders with May 6–7, 2026, pickups to call and confirm their trips. Public evidence points to IT Curves as the likely vendor, while Ababil of Minab separately claimed it compromised IT Curves and wiped and stole data; neither the vendor link nor the actor’s technical claims were confirmed.

West Pharmaceutical Services detected a cyberattack on May 4, 2026, in which an unauthorized party exfiltrated data and encrypted systems. The company took systems offline globally, disrupting manufacturing, shipping, receiving, and enterprise operations before reporting full operational restoration on May 20.

Exploitation of CVE-2026-41940 compromised Government of Guam web infrastructure and disrupted access to agency websites, downloads and public documents beginning in May 2026. The Bureau of Statistics and Plans later removed its restoration warning and repopulated report and data pages; the incident is presumed resolved because no territorial government all-clear establishes the exact recovery date.

A coordinated cyberattack forced the San Diego Community College District to shut down network systems, disrupting internet, Wi-Fi, websites, file servers, transcript processing, instruction and student services across San Diego City, Mesa, Miramar and Continuing Education colleges. Miramar directly confirmed the attack, while districtwide restoration proceeded by college and concluded with normal service status on May 15. The district said protected data was not compromised, and the public record does not establish ransomware or a threat actor.

DysruptionHub first reported Foxconn's multi-day Wisconsin network and production outage on May 5, 2026, before any other news publication identified in the reviewed chronology. Foxconn confirmed seven days later that a cyberattack affected some North American factories and said production was resuming, although workers at Mount Pleasant still described a slow, partial recovery. Nitrogen's claim of stealing approximately 8 TB of data remains unverified, and Foxconn has not identified every affected factory.

Kentwood Public Schools said a student used malicious software designed to disrupt its system, causing Wi-Fi connectivity problems throughout the Michigan district. Police investigated, outside experts helped isolate the issue, and the district said the technology problems appeared to have been resolved.

Instructure confirmed two related Canvas intrusions that exposed user, enrollment, course and message data and prompted a platform-wide outage May 7, 2026. Canvas returned to normal service, and the final incident-related Free-for-Teacher retrieval window ended July 29; continuing data review and notifications are breach-response activities rather than an ongoing service disruption.

Advanced Diagnostic Imaging, P.C., doing business as AdvancedHEALTH, said it detected suspicious activity on April 28, 2026 and determined that an unauthorized actor gained access to information on its systems. Columbia Surgical Partners had separately described ransomware at its parent and loss of EHR access. AdvancedHEALTH's June notice said its data review was ongoing and found no evidence of misuse; DragonForce's claimed 390 GB theft remains unverified.

Kent District Library disclosed a ransomware event after a computer outage beginning April 24, 2026 closed all 22 branches and disrupted public access to computers, printing and other services. Most services were restored by July 9, but KDL still reported limited printing and unavailable gaming labs while recovery work continued.

Harrison County, West Virginia, discovered ransomware-related computer disruptions around April 23, 2026, affecting courthouse services, tax payments and administrative functions while public-safety and election systems remained intact. Operations later returned to normal, but the county warned that personal information may have been accessed; SafePay claimed responsibility and data theft, but the county did not confirm the claim or resulting exposure.

Cherry Health experienced organizationwide technology issues in April 2026 that disrupted its phone system while clinics remained open. The provider later confirmed unauthorized access and copying of network data, and HHS listed the breach as a network-server hacking incident affecting 501 people.

A ransomware attack that Adams County officials said began April 17, 2026, disrupted county networks, digital court and public records, vehicle registration, and noncash payments while the sheriff's separate systems remained available. Most county IT was restored by early May, but vehicle-tag services were still unavailable on May 19; no ransom demand, data-theft finding, responsible actor or final restoration date was publicly established.

Tallahassee officials confirmed an April 17, 2026 cyberattack affecting parts of the city's technology environment, and the public website became unavailable that afternoon. City staff said they isolated the threat and initially found no operational impact, while Leon County disconnected a shared network link as a precaution and warned of possible outages in linked applications.

Maryland took the Department of Assessments and Taxation's statewide Real Property Search application offline after detecting suspicious server activity April 14, 2026, directing users to local assessment offices during the outage. The state restored and cleared the tool for public use April 27 after testing found no evidence of a broader compromise.

The City of Palouse, Washington restored its public website from a hosting-provider backup after officials said the site had been hacked. Some recently added content was missing and required re-entry, while the city reported that no sensitive data was involved.

Clinton County, Iowa, took portions of its network and internet connectivity offline after monitoring detected unusual activity consistent with the early stages of an attempted internet intrusion. The county said the threat was contained, all critical systems and services were restored by April 16, 2026, and later forensic findings showed no county data was accessed or extracted and no systems or records were damaged.

Spring Lake Park Schools discovered on April 12, 2026 that an outside actor had accessed district systems and shut systems down to contain further access. Classes were canceled for two days, along with child care and community programs, while the district restored phones, building security, fire-protection and other safety-dependent technology.

Signature Healthcare detected suspicious network activity on April 6, 2026, and shifted affected Massachusetts operations to downtime procedures. Brockton Hospital diverted ambulances, chemotherapy appointments were canceled, pharmacies could not fill prescriptions and electronic records services were impaired before staged restoration concluded later in April.

The Standard-Examiner in Ogden and Daily Herald in Provo, both owned by Ogden Newspapers, reported significant production difficulties that disrupted Monday and Tuesday newspaper printing and delivery in early April 2026 while their digital editions remained available. Qilin later listed only the Standard-Examiner on May 2, but neither newspaper has confirmed ransomware, data theft or a connection between the claim and the shared printing disruption.

Winona County detected a second, distinct 2026 ransomware attack on April 7 after malicious activity began April 6, prompting a local emergency declaration, system isolation and Minnesota National Guard cyber assistance. DMV and vital-statistics services remained offline on April 10, the county reported secure restoration of its network and critical public systems by April 24, and it later confirmed that attackers released information acquired from the network.

A cyber incident at Minidoka Memorial Hospital in Rupert, Idaho, temporarily affected internal systems, limited imaging services and prompted transfers of some emergency patients, while the hospital and clinics continued treating patients. Full imaging access was restored by midnight April 19, 2026; a Blackwater leak-site claim alleging data theft remains unverified and was not confirmed by the hospital.

Karl Auto Group discovered on April 4, 2026, that an unauthorized third party had accessed business systems, disrupting phones and computers across its Iowa dealership operations. The company said files may have contained sensitive customer and employee information, while RansomHouse separately claimed Karl Chevrolet and alleged encryption; ransomware, exfiltration and a connection to that actor remain unconfirmed.

Chevin Fleet Solutions took affected U.S. and U.K. FleetWave environments offline after disclosing a cybersecurity incident on April 2, 2026, causing a major service outage for fleet-management customers. Missouri's state fleet system became unavailable and required phone workarounds, while Chevin later confirmed unauthorized access to customer databases containing operational and personal information.

Uplink documented a cybersecurity event that disrupted BAT-MINI alarm signaling and interactive services used by dealers and monitored accounts across the United States from April 2 to April 4, 2026. The M2M Services-owned brand restored all BAT-MINI services by April 4 but did not disclose the event’s cause, affected-account count, data impact or a responsible actor.

Belgrade School District in Montana confirmed that malware affected systems in its network after technology problems began in early April 2026. The incident disrupted routine school functions, including lunch processing and assignments, while restoration continued and the district reviewed whether student or staff information outside Infinite Campus was affected.

Gritman Medical Center described an electronic-systems outage that closed multiple outpatient clinics beginning April 1, 2026, while its hospital and emergency department remained open. Clinics reopened April 6, although four rural sites still had phone outages; the provider called the event a cybersecurity incident but reported no successful system access or known patient-data compromise in its preliminary findings.

A ransomware attack discovered March 31, 2026, directly affected the Patriot Regional Emergency Communications Center and the Town of Pepperell, disrupting Pepperell's network for about one week and non-emergency public-safety phone service across PRECC's five member towns. PRECC is a joint regional service administered day to day by Pepperell and governed by representatives of Ashby, Dunstable, Groton, Pepperell and Townsend; it is not a separate municipality. 911 and emergency response continued, and available evidence does not show that the other four towns' municipal networks were compromised.

Hasbro identified unauthorized access to its network on March 28, 2026, took certain systems offline and used business-continuity measures while restoring operations. The incident disrupted order processing, shipping and invoicing throughout the second quarter, with Hasbro estimating an approximately $25 million revenue impact before returning to pre-incident practices.

The City of Martinsville, Virginia, detected a cyberattack March 25, 2026, that disrupted computer systems and delayed or limited services in the municipal building. City Manager Robert Fincher said April 9 that city services were fully operational. A later city notice said personal information might have been accessed but reported no evidence of misuse.

Ransomware disabled the Jackson County Sheriff's Office network in Indiana in March 2026, leaving computers, Wi-Fi and the police-report system inaccessible. Dispatchers shifted to Seymour Police Department computers, officers wrote reports in Word documents and technicians rebuilt the environment while officials said the county would not pay a ransom.

North Attleborough Public Schools detected unauthorized network activity on March 25, 2026, and later shut down districtwide internet access as a precaution. The outage disrupted communications and limited classroom technology access, but instruction continued and officials said all network connectivity was restored by April 1.

Puerto Rico security monitors detected and neutralized a cyberattack attempt against DTOP on March 23, prompting officials to disconnect systems and pause CESCO appointments across the territory. CESCO centers resumed regular operations March 26 except Utuado, which still required additional validation. Officials said resident information remained secure, and no stable public actor claim was identified.

The Town of Colebrook said a municipal email account was hacked, prompting New Hampshire to suspend state-system connections serving the Town Clerk's Office and dispatch. The disconnection interrupted vital-records, election and DMV access; vital records and election functions were restored by March 27, 2026, while DMV and dispatch reconnection remained pending.

Foster City found ransomware on municipal networks March 19 and shut down its network, pausing most non-emergency public services while 911 and police dispatch remained operational. Phone and email connectivity returned March 27, but virtual services were still being restored; on April 7, the city still lacked full network access despite restoring permitting and recreation registration. No stable public actor claim was identified.

An unauthorized actor accessed an Infinite Campus employee's Salesforce account March 18, 2026, prompting the company to disable some customer-facing services while investigating an extortion demand. ShinyHunters claimed the intrusion, and data associated with about 137,100 school-staff accounts was publicly released and indexed; Infinite Campus did not name the actor. The service disruption is presumed resolved, while data publication is confirmed.

Mile Bluff Medical Center disclosed an April 2026 security event involving data encryption that disrupted phone and computer functions and forced clinical teams to use downtime procedures while patient care continued. A later breach notice said an unauthorized actor had accessed the network from March 18 through April 19 and copied files, while the electronic health record was not affected.

Clayton detected suspicious network activity on one system March 18 and manually took its network offline, limiting phones and online services during restoration. By March 23, investigators said attempted data access was unsuccessful and found no evidence that customer or employee data was compromised. No stable public actor claim was identified, and no later continuing impact was found.

Pro-Iran imagery and a Farsi control message replaced the Yeshiva World News homepage March 18, interrupting access to the outlet's website and articles before it displayed a maintenance page. The website later resumed normal publishing. No stable actor claim or evidence of ransomware or extortion has surfaced, leaving attribution unresolved.

CareCloud said an intruder accessed one of its six electronic health record environments from March 10 to March 16, 2026, disrupting functionality and data access for about eight hours before restoration. Forensic analysis confirmed data exfiltration, and breach filings showed at least 345,000 people across the United States were affected by theft of medical, identity and financial information. No stable public ransomware or extortion claim identifies a responsible actor.

LA Metro restricted internal administrative systems after detecting unauthorized activity March 16, disrupting arrival information and some TAP fare-loading channels while buses and trains continued operating. Ababil of Minab claimed the intrusion; later technical research found LA Metro data on infrastructure tied to the operation, supporting high-confidence attribution and data theft but not the actor's claimed destruction or exfiltration volumes. The incident is presumed resolved because no continuing operational impact has been documented since April 2.

At Sage Water Resources' Duchesne, Utah, saltwater-disposal facility, an attacker altered PLC safety logic on March 15, 2026, bypassing shutdown protections and leaving pumps running dry while the control system showed normal operation. A truck driver spotted the mismatch; workers shut down automation, continued receiving wastewater under manual control, and avoided pump failure, service interruption and environmental harm. Sage said a contractor rebuilt and verified the safety logic and restored continuous operation within days.

A cyberattack disrupted network resources used by Goodwill Industries of Greater Grand Rapids at 18 stores across six western Michigan counties in March 2026, forcing cash-only sales while the nonprofit rebuilt its point-of-sale program. An Interlock listing contained material appearing to identify the regional affiliate despite an incorrect Pennsylvania label, but Goodwill did not confirm ransomware, data theft or attribution.

Minot officials said ransomware affected a Water Treatment Plant SCADA server March 14, 2026, prompting isolation and about 16 hours of manual monitoring before a backup restored local visibility. A connected Northwest Area Water Supply system returned to full operation March 17, but its data link with Minot remained disabled May 20 while water safety, pressure and customer service remained intact.

A March 2026 network intrusion disrupted Aroostook Mental Health Center connectivity and business operations across its service area in Aroostook, Hancock and Washington counties. Qilin claimed the organization on March 24, and AMHC later confirmed that an unauthorized actor accessed its network on March 11-12 and copied files containing personal information. The federal breach portal lists 501 affected people, while the Maine filing leaves the total undetermined.

NewspaperArchive said an unauthorized third party remotely accessed and encrypted systems hosting its historical-newspaper platform in February 2026, making the service unavailable to libraries and subscribers. Core search and download functions returned during a phased recovery, but some publications and personal accounts remained unavailable as of May 19.

A technology outage closed Town Hall, Public Works and Community Development offices in Orange, Virginia, for parts of three days in February 2026 and temporarily limited Town Hall payments to cash or checks. LockBit listed `townoforangeva.gov` on its leak site March 5, providing concrete external cyber evidence but not proving that ransomware caused the outage, that data was stolen or that the town confirmed the claim.

A Pinellas County arrest affidavit alleges that a former Clearwater Public Library System technology employee used a library administrative account on February 5, 2026, to remove Deep Freeze security software from about 200 public computers. The action led the city to shut down patron computers at three Florida library branches, while the accused employee pleaded not guilty and no theft, fraud or misuse of personal information was alleged.

Winona County detected ransomware on January 22, 2026, after unauthorized network access that began January 18, disrupting phone lines, internal systems, records access and other county services. The county later confirmed data theft, reported 6,196 affected people to regulators, securely restored the network and began notifications with 12 months of identity-protection services in May.

Milton, Florida, detected suspicious activity consistent with ransomware on December 26, 2025, and secured its network. Utility billing, automatic payments and online payment services were disrupted into spring 2026, while investigators reported no evidence that city information was taken.

Northwest Iowa Community College experienced a computer network disruption in late November and early December 2025 that canceled on-campus classes and impaired campus technology services. The college later confirmed unauthorized activity and said information may have been accessed or downloaded between November 24 and November 26, 2025. Its July 2026 breach filing identified 16,004 Iowa residents whose names and Social Security numbers were potentially affected.

Unauthorized activity in Bellflower Unified School District's network disrupted internet, phone, and on-premises services in August 2025 while staff rebuilt the environment. A later district breach notice said personal information may have been accessed, while Rhysida's claim and alleged data publication remain unconfirmed attribution rather than official ransomware confirmation.

A ransomware incident that began on July 8, 2025 disrupted City of York email, computers and parking-garage kiosks for weeks. The city's insurer reportedly negotiated a $1 million demand to $500,000 and paid it, and York later confirmed that an unknown actor accessed its network and accessed or acquired files.

A former Saydel Community School District IT employee used retained credentials from at least May 14, 2023, through January 2025 to access district systems and disrupt accounts, classroom platforms and managed devices. Ezekiel Dean Potter pleaded guilty to computer fraud and was sentenced June 11, 2026, to 21 months in prison and $59,668.81 in restitution.