Cyber Incident Registry

A cybersecurity incident at the University of New Mexico Health System diverted ambulances and canceled clinic appointments Oct. 26, 2026, while Health Sciences students and nonessential personnel were sent home. A BYOD claim alleges extensive university and hospital compromise, but attribution, data exposure, ransomware involvement and full recovery remain unresolved.

Oneonta City School District in New York announced student closures Oct. 23 and 26, 2026, after discovering a reported ransomware attack Oct. 22. Its technology team took steps to limit further unauthorized access and potential damage. Students were expected back Oct. 27; affected systems, data exposure and full recovery remained unresolved.

Quest Diagnostics suspended Quanum Lab Services Manager after discovering unauthorized access on Oct. 21, 2026, interrupting some clients' test ordering and results access. Essential Insights and LabHQ were also paused, while direct laboratory interfaces and core operations remained available. Patient information was accessed, but the affected population, specific data and full restoration remained unresolved.

University Hospitals disconnected systems after detecting unusual server activity Oct. 22, 2026, disrupting MyChart and public website services. Patient access remained limited Oct. 23, with telephone workarounds and several more days of digital disruption anticipated. UH reported no current effect on patient care delivery; cause, data exposure and full recovery remained unresolved.

A reported cyberattack on a platform serving Arizona's Empowerment Scholarship Account program prevented some vendors from doing business with families. State Affairs reported Sen. Shawnna Bolick's security concerns in October 2026, while the affected operator, technical scope and restoration remained unresolved.

CivicPlus' precautionary PHP-related shutdown affected municipal websites and other products. Web Open and Community Development v4 were marked resolved; v3/FMO and Cost Recovery remained offline when checked Oct. 23. Naples and Quincy websites were accessible. Exploitation and data compromise remained unestablished.

Richmond Public Schools' cybersecurity incident disrupted internet access, email and classroom tools. By Oct. 22, front-office phones were online; the district said outbound and emergency calls had continued working. Classes remained open with adjusted instruction, while internet restrictions and the investigation continued.

TAKKT AG disclosed a cyberattack Oct. 21, 2026, affecting its North American Foodservices and European Industrial & Packaging systems. Order processing, customer service and deliveries were significantly restricted while some systems were offline. Effects on individual brands, recovery timing, data impact and ransomware involvement remain unresolved.

Ransomware disrupted Columbia's municipal online services after an incident discovered Oct. 20, 2026. Selected applications and permitting remained restricted while police, fire, 911, water and general online payments continued operating. Data exposure, attribution and full recovery remain unresolved.

Railway paused builds and deployments during an October 2026 intrusion that exposed customer secrets and disrupted platform management and support, including U.S. build regions. Railway said running deployments stayed online, while freddy reported a downstream outage that required a restart. Railway marked the main outage resolved on October 23, while ancillary restrictions and exposure questions remained.

Community Medical Center in Falls City experienced a cyberattack over the Oct. 17–18 weekend that forced paper workflows, disrupted appointments and diverted critical ambulance patients. Its emergency room remained open while a replacement network was deployed. Patient-data impact and reported Qilin responsibility remained unconfirmed.

Loxone's cyberattack disrupted U.S. ordering and logistics. The company confirmed attacker-encrypted databases and restored U.S. shipping by Oct. 21. Its current FAQ says webshop ordering has returned, while the Partner Portal remains unavailable. Complete service recovery and final data findings remain unresolved.

Jerome School District canceled classes Oct. 19 and 20 after a cyberattack affected networks, cameras, door locks and climate controls. Local radio reported students returning Oct. 21. A ransom demand was reported, while full technical recovery and final data findings remained unconfirmed.

Parkview disabled its network after suspicious activity, disrupting MyChart and provider search. Its current website notice, observed Oct. 25, says all services are restored and no patient information was compromised. The restoration date and underlying activity remain undisclosed.

Bullhorn's Oct. 17 cyber incident disrupted staffing workflows. By Oct. 22, access and several integrations had returned, while job publishing, administrative setup and other features remained restricted. Final data findings and complete functional recovery remained unresolved.

OpenCode disclosed a breach of its hosted Console affecting 1.4% of Console users, with saved AI-provider keys potentially exposed and users reporting access failures. Providers revoked affected keys, and OpenAI reported restoring access and refunding attack-related credits Oct. 19; incident-wide recovery remains unresolved.

Unauthorized access to ConnectWise application identities interrupted Cloud Backup and related services. The vendor's Oct. 24 update targeted conditional phased onboarding and backup-restore access for Oct. 26; full partner capabilities remained unconfirmed. Microsoft attributed the activity to Storm-0940.

Lakin Unified School District 215 in Kansas shut down Wi-Fi to contain a breach that its technology engineer found was isolated to a copier server. The district said its system had been restored by its Oct. 14, 2026, announcement and that no student or staff information was accessed. The intrusion date, shutdown duration and exact restoration date remain unknown.

Colorado County, Texas, documented disruption to information systems and operations by Oct. 13, 2026, prompting emergency meetings on restoration and essential-service continuity. NightSpire listed “Colorado Texas,” but the connection to the county, cyber cause and data impact remain unverified.

Ahold Delhaize's October 2026 cyber incident disrupted online grocery services at five U.S. brands while stores stayed open. The brands restored websites and apps Oct. 20. Complete internal-system recovery, the attack method and any data theft remain unconfirmed.

CUSI utility payment services were disrupted in October 2026, affecting online accounts, bill payments, Quick Pay and telephone payments at multiple customers. Hopedale, Culleoka and Kempner reported recovery Oct. 13–15; Penrose reported its portal restored Oct. 20 and asked customers to check payment records for possible discrepancies. The full customer scope and vendor-wide recovery date remain unestablished. Kempner attributed its disruption to a third-party processor security incident; the compromised component, ransomware involvement and data impact remain unknown.

A cyberattack breached Heber City's local IT network in Utah on Oct. 10, 2026, prompting containment and system restoration. KUTV reported Oct. 15 that systems were fully back online, the city's website was unaffected and no essential services were suspended. The FBI was assisting with a forensic investigation; ransomware involvement and data exposure remain unresolved.

Stolen city credentials caused the Oct. 9, 2026, cyber incident affecting North Platte and Lincoln County, the mayor said Oct. 16. Phones and office operations had largely returned by Oct. 12. He said outside specialists found systems secure and no information taken; the attacker and exact full-restoration date remain unresolved.

A cyberattack disrupted Bernalillo's municipal network, online payments and Motor Vehicle Division services in October 2026. The mayor said most systems were back by Oct. 20, but MVD restoration remained a goal and some staff used workarounds. Police and fire response continued; the attack method and data impact remain unresolved.

A cybersecurity incident disrupted the Bankruptcy Noticing Center's production and distribution of federal bankruptcy notices in October 2026. The BAE-operated service remained unavailable in an Oct. 21 court update, while electronic filing and separate filing-notification emails continued. Full restoration and any data impact remain unresolved.

U.S.NEXT's cyberattack disrupted hosted websites and email, including Mississippi law-enforcement communications and West Point's normal utility-payment route. Madison County said the website outage caused sealed bids and reverse auctions to be canceled. The provider confirmed POP and webmail restored Oct. 16; completion of its scheduled Oct. 22 IMAP recovery remains unconfirmed. Some customer websites are accessible, while broader website recovery and data scope remain unresolved.

The Maryland State Department of Education took its website offline as a precaution during a cybersecurity investigation, according to an Oct. 7, 2026, report by Chris Papst quoting the department. A streamlined replacement site provided an alternate access channel, while the full scope and restoration of the original site remained unresolved.

A cyberattack on Senture disrupted the Federal Motor Carrier Safety Administration's contact-center phone services and Motus registration support, according to DOT's Oct. 14, 2026, confirmation to Politico. FMCSA's Oct. 6 notice directed users to web tickets and chat, and DOT said agency data was not compromised. Ransomware, attribution, AI involvement and recovery timing remain unresolved; an undated restoration notice does not establish when this attack's effects ended.

Easthampton Public Schools shut down its network Oct. 5, 2026, after staff spotted suspicious activity, limiting phones, email, Wi-Fi and classroom technology. Both schools remained open, using paper-based instruction, manual coordination and borrowed hotspots while forensic specialists investigated.

Indiana Area School District's Oct. 4, 2026, cybersecurity incident disrupted a local server and desktop access. In an Oct. 15 interview reported Oct. 16, the superintendent described continuing recovery and effects on lunch payments, with at least a $25,000 insurance deductible. Schools remained open; full recovery and data scope remain unresolved.

A BankMobile account compromise disrupted financial-aid refund delivery at several California community colleges in October 2026. Butte College said Oct. 15 that refunds would use paper checks for the rest of the fall semester; Shasta College continued checks until further notice. Vendor breach scope and full recovery remain unresolved.

Green Clinic in Ruston, Louisiana, confirmed a ransomware attack detected Oct. 2, 2026, encrypted network files and systems, leaving electronic patient records unavailable and severely limiting care. Its Oct. 8 statement associated the attack with an actor identifying itself as Wall Street or an affiliate. Broader care using a new system was planned for Oct. 14; data exposure and full recovery remained under investigation.

Network problems at the Institute of American Indian Arts began Oct. 2, 2026, and led to an emergency campus closure notice Oct. 8. Recovery included restoring a late-September backup, with possible file loss; the cause and full restoration remained unresolved as of Oct. 23.

A September 2026 network intrusion at Sangre de Cristo Electric Association disrupted bill payments and telephone services after the Colorado cooperative isolated its IT servers. The cooperative says both services were restored and electricity was unaffected. INC Ransom claimed the utility, but responsibility and its broader data-theft allegations remain unverified.

A ransomware attack temporarily made some University of Illinois Chicago College of Medicine systems unavailable, and UIC said information was stolen from college servers. UIC said affected systems had been restored by Oct. 5, 2026, with no impact on its main network or UI Health patient care; a Booba Project data-volume claim remains unverified.

Vicksburg's ransomware incident disrupted municipal computers and utility billing. The mayor said Oct. 19 that the city missed a billing cycle and still could not accept Water and Gas payments, with recovery hoped for within days. Utility delivery and emergency services continued; full restoration and data impact remain unresolved.

Jefferson County, Missouri, could not process transactions after phone and server problems and canceled two public meetings. Officials said a network security threat led them to take systems offline; the network was still disrupted Oct. 7 while they worked toward restoration. The sheriff's law-enforcement functions were unaffected, and no data breach had been indicated.

Big Spring, Texas, reported a network disruption that disabled electronic water-bill payments by Sept. 30, 2026. An Oct. 13 notice confirmed continuing billing delays and protections against late fees and disconnections while systems were restored. The cause, data impact and final restoration date remain unresolved.

Terrebonne Parish's Sept. 30, 2026, cyberattack disrupted network and online services. A parish notice observed Oct. 19 warns that resident, employee and vendor information may have been accessed and downloaded. Essential services continued; full restoration, verified data scope, ransomware and attribution remain unresolved.

An internet outage associated with a possible data incident disabled Radford's office email, most phones and several municipal services in late September 2026. Most services had returned by Oct. 5, but DMV Select, online GIS tax cards and September utility billing remained affected. Malicious causation, data exposure and full restoration remain unconfirmed.

Llano Independent School District reported network, internet and phone outages Sept. 29, directing people to campus offices for contact. The next day, the district acknowledged a cybersecurity incident affecting its IT network and said it had taken certain systems offline. Full restoration, ransomware, data exposure and Qilin responsibility remain unconfirmed.

Kiteworks lifted its precautionary shutdown recommendation Sept. 27 and said vendor-hosted systems were operating normally. It later disclosed a critical flaw found and fixed during the shutdown, with no indication of exploitation or compromise; customer-managed restoration remained deployment-specific.

Phishing targeting vendors in South Carolina’s Education Scholarship Trust Fund program prompted account restrictions and interrupted payments through ClassWallet in late September 2026. Officials estimated $100,000 was diverted, while schools and businesses reported delayed funds or services. Some accounts recovered by Oct. 5, but full restoration and final losses remained unconfirmed.

Unauthorized network access disrupted Stevens Point services Sept. 23. The city said it blocked a suspected ransomware attempt before execution. Recovery was still affecting police records reporting Oct. 7, when no weekly public police report was available. Full restoration, final data findings and attacker identity remain unconfirmed.

Astemo suspended external inquiry forms after unauthorized access to its data-sharing cloud through a compromised contractor account. The company says the contact form resumed accepting submissions Oct. 22, 2026. The disruption included the shared channel linked by its Americas aftermarket website. Astemo confirmed theft of business-contact information relating to about 350 people; final data scope remains under investigation, and significant wider business disruption or internal-network ransomware infection has not been confirmed.

A compromise involving FBIjobs.gov disrupted recruiting access and exposed personnel information. The FBI linked the breach to a contractor's failure to apply a security patch on a third-party platform. By Oct. 22, 2026, public job listings and an application sign-in screen were available; complete restoration and the full data-exposure scope remained unresolved.

Elsevier's Sept. 21 web redirects disrupted coursework and manuscript access. The redirects cleared, but Moffitt Cancer Center still displayed a precautionary block of Elsevier research and clinical-reference resources when checked Oct. 25; no Moffitt breach or patient-care disruption was established.

A September 2026 network security incident disrupted Spokane Public Schools' student-information and payroll access. The district later reported reason to believe student and staff data was compromised. PowerSchool and payroll access returned, but its dashboard documented partial service limitations Oct. 6; full recovery and the affected records remain unresolved.

Ellis County, Kansas, said a ransomware incident affected portions of its information technology systems, leaving some county services unavailable, delayed or operating under temporary procedures. The county said 911 and emergency public-safety response remained unaffected, while the investigation and recovery continued and data exposure remained unresolved.

Direct Communications said a distributed denial-of-service attack disrupted internet service in Eagle Mountain, Utah, beginning Sept. 17, closing City Hall and the library and affecting provider phone and billing systems. The provider said service was restored Sept. 21 and continued investigating and hardening its network. Data impact and actor attribution remained unresolved.

The Well Outreach disclosed Sept. 17 that two Microsoft email accounts were accessed without authorization. It disabled the accounts, forced logouts and warned partners and donors to scrutinize messages. Sept. 19 reporting described recovery; data exposure, ransomware and attribution remain unresolved.

The City of Princeton disclosed a cybersecurity incident in September 2026 affecting municipal systems and later confirmed theft of confidential and personal information. The city said essential services continued normally, while the public record does not establish whether other services or internal workflows were disrupted.

Weld Re-8 School District isolated systems after unusual IT activity Sept. 13, 2026, disrupted network drives, printing and internet access. An official notice checked Oct. 23 described most devices restored, remaining system recovery and intermittent phones. The mechanism, data impact and full recovery remain unconfirmed.

Fenway Health's IT disruption delayed patient communications and coincided with a clinic cancellation. A Sept. 13 spokesperson statement described continuing restoration; patient reports add prescription-fill problems, while cause and full recovery remain unconfirmed.

Gyazo's cyberattack exposed user records and image metadata and suspended service. Helpfeel's Oct. 21 final report confirmed 432 image files belonging to 133 users were viewed or obtained. Service has resumed; older images require owners' sharing choices under a permanent policy. The operational disruption is presumed resolved.

A possible network security issue disrupted Monroe schools' computers and phones Sept. 10, 2026. WiscNet restored connectivity Sept. 14, but the superintendent described partial recovery and delayed ACT preparation at the Sept. 21 board meeting. Full restoration, cause and data impact remain unconfirmed.

An unauthorized message replaced traffic information on a Caltrans-operated digital sign along Interstate 405 near Westwood on Sept. 8, 2026. Caltrans said it learned of the message Sept. 15, directed its contractor to restore normal operations and began reviewing the message and access history; the access method, actor and restoration time remain unconfirmed.

Hilltop National Bank's cyber incident disrupted digital banking, closed Wyoming offices and complicated customer payroll. After phased restoration, the bank said all systems were operational Sept. 24, ending the documented service disruption.

North Slope Borough School District detected a cyber incident that disrupted districtwide phone service Sept. 8, 2026, and led to temporary school contact numbers. In-person instruction continued, and the district reported normal operations by Oct. 5. A Vermont filing lists one affected resident, but the overall data impact, ransomware use and INC Ransom responsibility remain unconfirmed.

A Sept. 7 cyberattack stopped Mississippi's student financial aid office from processing applications and payments and disrupted enrollment verification uploads; MAAPP continued accepting applications and individual universities were not reported affected. The office announced normal operations and full functionality Sept. 23 while processing outstanding work. Data impact, ransomware and attribution remain unresolved.

Everett closed City Hall Sept. 8-17 after a cybersecurity incident affected municipal systems, shifting basic services to the Connolly Center while public safety and several other services continued. City Hall reopened Sept. 21 with regular municipal services; Everett said the incident was contained and a very small amount of city data was affected, while review of possible personal-information involvement continued.

Greenville County Schools' Gmail suspension was reported by Sept. 5, with a Sept. 9 district statement describing phishing messages and a precautionary response. Google Classroom and files remained available; no dated restoration confirmation was found.

A Sept. 3, 2026, cyberattack disrupted Slate Valley Unified Union School District's internet, email and educational technology. Officials confirmed staff-data compromise and rejected an extortion demand; independent reporting also examined samples containing current-student and dependent information. Systems returned in stages, while encryption, the full data scope and Kairos attribution remain unresolved.

Ransomware disrupted Alabama Board of Nursing licensing and regulatory services Sept. 1, 2026, forcing paper applications and verification workarounds. Online single-state RN/APRN renewals reopened Oct. 15, but monitoring reports still required paper forms Oct. 21. The board confirmed downloaded data; the full exposure scope and attacker remain unresolved.

Springfield's school cyberattack closed 64 schools and exposed district records. Its Oct. 23 update said staff laptop rebuilding was nearly complete, student restoration continued, and investigators now considered all current employees' Social Security numbers likely compromised. Full recovery remained incomplete.

Westfield Public Schools experienced a network disruption while schools stayed open. Substantial recovery was reported Sept. 15, 2026, but elementary Chromebook onboarding continued and parent-portal access remained pending. Ransomware, data theft and INC Ransom attribution remain unconfirmed.

A cybersecurity incident disrupted Luminis Health patient systems and care. The health system reported systems restored Oct. 8, while staff continued entering downtime records and resetting paused payment plans. Investigation into possible information exposure and attribution remains unresolved.

McKesson's August service disruption is resolved. September disclosures narrowed customer-data exposure; an external breach index reported 6.4 million unique email addresses in an alleged leaked corpus, not a confirmed patient count.

The Bureau of Alcohol, Tobacco, Firearms and Explosives shut down a breached standalone system containing information about targets of ATF investigations, creating a limited loss of an internal investigative resource while the agency retained its broader mission capability. Qilin later began publishing files that CNN and an independent researcher said appeared to contain ATF investigative material. ATF has not authenticated the files or attributed the incident, and no public evidence establishes ransomware encryption.

The City of Circleville, Ohio, confirmed ransomware activity affecting portions of its municipal technology environment. The city said operations were restored, affected systems were rebuilt or recovered, no ransom was paid and it was not aware of evidence establishing that sensitive information was exfiltrated. The exact incident and detection dates remain unresolved.

Refrigeration failures were reported at least 14 Defense Commissary Agency stores across 10 states beginning August 26, 2026, restricting chilled and frozen food sales, halting Click2Go at one store, forcing inventory transfers and causing product loss. Three military criminal investigation agencies later confirmed investigations, and Fort Irwin used emergency food orders after repairs were completed August 31. DysruptionHub assesses it is likely, with medium confidence, that malicious or unauthorized cyber activity contributed; no public evidence confirms a malicious cause or common mechanism.

Boston Scientific restored disrupted operations Sept. 9. Later disclosures identified limited on-premises access, scoped negative data findings and likely material 2026 financial impact; NHS Supply Chain closed its cyber disruption notice Sept. 25.

An Aug. 25, 2026, ransomware attack disrupted Merrimack County systems, police data access and electronic deed filings. The county said it used backups to restore systems without paying a ransom. The final restoration date and possible personal-data impact remain unresolved, and a Booba Project data-theft claim is unverified.

Northern Counties Health Care disclosed an August 2026 cybersecurity incident that limited some technology functions while its Vermont clinics remained open. The provider warned patients of possible minor delays; the affected systems, actual patient delays, data impact and full recovery date remain unconfirmed.

Suspicious activity prompted UC Berkeley to restrict EECS networks and take systems offline. IRIS marked the outage resolved Oct. 8 after restoring user-facing services, with configuration work continuing. Data exposure, intrusion mechanism and attribution remain unresolved.

Franklin Mint Federal Credit Union lost website, mobile-app, email, text and digital-banking access beginning August 24 after fmfcu.org transferred registrars and routed to a domain-sale page. FMFCU restored its website and digital banking by August 26, and its current FAQ no longer identifies a remaining unavailable service; core systems, funds and transactions remained available throughout. The incident is presumed resolved operationally, while the cybersecurity investigation, transfer authorization and possible data impact remain unresolved.

Alation confirmed unauthorized activity in one of its systems after an Aug. 18, 2026, service incident degraded Alation Cloud availability for a limited number of customers in its Americas U.S.-East region. Alation restored affected services within an hour, but the public record does not establish whether the unauthorized activity caused the disruption or whether any data was accessed or removed.

Algonac officials said the city water filtration plant experienced a cyberattack targeting cellular modems used to communicate with remote PLCs, but the incident was contained without significant operational impacts. The timing, device class and UIS SCADA remediation closely match the late-July 2026 water-utility campaign, though no public authority has named Algonac as a confirmed campaign victim.

The City of Fort Scott shut down City Hall and its core network after detecting ransomware Aug. 18. Several non-critical machines at municipal sites were affected, while public safety and SCADA remained isolated; officials said full operations were restored by Aug. 23.

Lansing Urgent Care shut down its system after detecting an outsider's attempt to access its network, but did not identify the shutdown's date, duration or effect on patient care. INC Ransom had listed the provider about 24 hours before the first public account, yet the displayed administrative documents do not prove ransomware, data theft or INC's responsibility. No continuing clinic or patient-facing disruption was found by August 30, so the incident is presumed resolved operationally while forensic and attribution questions remain open.

Fort Smith's August 2026 network intrusion disrupted municipal systems and led to confirmed data theft, publication and a ransom demand. Public payment services returned, but an Oct. 23 report described continuing internal police-system disruption. Final data findings, full recovery and Interlock attribution remain unconfirmed.

UT San Antonio took technology systems offline after detecting attempted unauthorized activity in August 2026, disrupting accounts, registration, payments and phones and delaying fall classes. Classes resumed Aug. 24 as services returned in phases. The university has not issued an incident-wide technical all-clear or established an exact full-restoration date.

Cedar County Memorial Hospital experienced a cyber incident that led it to shut down its IT networks, use hospitalwide downtime procedures and partially divert emergency patients who needed advanced imaging. Routine operations returned Aug. 28, while ransomware, Wallstreet responsibility and possible patient-data exposure remain unconfirmed.

A cyberattack disrupted Andover’s shared municipal and school systems beginning Aug. 13, 2026. Recovery continued through Aug. 21, when shared files returned but remote VPN access remained unavailable. The town confirmed unauthorized access Oct. 8 and denied making or authorizing payments; data acquisition and Wallstreet’s claim remain unverified.

Encrypted files disrupted Lincoln municipal systems and closed the town office in August 2026. A later forensic investigation found that some town data was potentially acquired, although sensitive-data involvement, notification requirements and misuse remain unresolved.

Namecheap services and customer websites worldwide went offline August 13 during a cooling-system failure at its Phoenix data center. An early Namecheap status notice reportedly attributed separate Private Email and Jellyfish disruption to a DDoS attack, but the broad outage and staged restoration were tied to unsafe temperatures; full service was reported restored August 14.

Plymouth County Correctional Facility shut down its computer system after detecting unauthorized server access on August 13, suspending in-person visits because staff could not retrieve visitor-clearance records. Attorney visits and incarcerated people's tablet and phone access continued, while state police, the FBI and the Department of Homeland Security investigated. The public record does not establish ransomware, extortion, a threat actor or whether information was acquired.

Darlington County said on August 12, 2026, that a cybersecurity incident affected computer systems and limited services. Regular phone lines at two magistrate offices and the Historical Commission were unavailable, while emergency services and 911 dispatch remained operational. The county's live alert still listed those lines and the Clerk of Court juror-information lines as unavailable September 2.

Attackers exploited a WordPress vulnerability in a public-facing UNMC environment, accessed the web server and placed malicious web shells. UNMC's Brand Wise website was unavailable by Aug. 12, 2026, and the university announced its return Oct. 5 after forensic work, rebuilding and added security controls. UNMC said it found no evidence of sensitive data loss.

Suspicious computer-system activity prompted the Douglas County Sheriff's Office in Kansas to disconnect systems in August 2026, disrupting inmate reports, fingerprint scheduling and shared records access at Lawrence Police. Public inmate-report and fingerprint-scheduling interfaces were available by Sept. 26, but full shared-system recovery was not confirmed. A former Eudora IT administrator alleged ransomware and a connection to Eudora's same-day incident; officials have not confirmed either.

Brazosport College identified a cybersecurity incident affecting its network on August 10, 2026, and took academic, communications and student-record systems offline for phased restoration. D2L returned August 17, and most campus internet and Wi-Fi services were restored by August 20, but guest Wi-Fi remained unavailable. On August 26, the college required students whose passwords predated the incident to reset them, while Qilin's claim of internal data remained unverified.

Brown City officials said a cyberattack changed the IP address of Well No. 3 and stopped the municipal well from producing water until staff restored it within a couple of hours. No actor, ransomware or data theft is established, but the cellular connection, configuration change and UIS SCADA context closely match the late-July 2026 water-utility campaign.

LexisNexis took Nexis Diligence, Nexis Metabase API and Nexis Newsdesk offline after unusual activity was identified on vendor-managed servers. Diligence returned during the August 8-9 weekend with its content catalog still rebuilding, and the other two services were expected to return August 10 after testing. No later continuing service impairment tied to this incident was found by August 30, so the incident is presumed resolved even though the exact restoration time and data impact remain unknown.

Wake County stopped using ElectSure's election-worker training and registration platform after learning August 7 that a hacker had obtained a vendor password with read-only access to records for about 9,000 precinct workers. The county revoked that access and moved to a replacement process, ending the affected platform's operational role; voting machines, ballots, voter-registration records and vote-counting systems were not connected or affected. No continuing registration or training disruption was found by August 30, so the incident is presumed resolved even though the investigation may continue.

The Hamilton Township Municipal Utilities Authority said it identified a likely attempted cyberattack on August 5, isolated and removed the threat, and reported the event to the FBI. The New Jersey utility called the attempt unsuccessful and said drinking-water quality was not affected; DysruptionHub assesses that this may describe the absence of an intended or public-facing consequence rather than prove that no system was reached. The attack timing, affected systems, extent of access, operational effects beyond water quality and any data impact remain unresolved.

Malware compromised Suisun City's IT systems Aug. 7, disrupting 911 routing, dispatch, records, payments and municipal services and forcing City Hall closures. All City Hall departments reopened to the public by Sept. 22, but full network restoration was still underway and city dispatchers continued using the Solano County dispatch center. Data impact, encryption, payment and actor attribution remained unresolved.

The City of Lancaster, Ohio, took municipal computers offline after ransomware notifications on Aug. 6, 2026, warning of delays in card payments and other computer-based work. By Aug. 28, the city had restored about 90% of affected data and programs, but recovery remained incomplete and some material might not return for security reasons.

Coryell County reported a technology disruption affecting several systems August 6 while emergency and essential services continued. No continuing limitation surfaced over the next 25 days, and ordinary county service pages remained available, supporting presumed resolution.

Mitchell, South Dakota, shut down a limited network segment Aug. 6, 2026, after unauthorized activity. Services were restored by Aug. 12. On Sept. 28, the city said a small number of employees' data were impacted and those affected were notified; it reported no indication of malicious data use. Storm's claim remains unverified.

Washburn County shut down technology Aug. 6, 2026, after detecting malicious cyber activity, disrupting communications and internet-dependent services. Departments were functional Sept. 2, residual restoration continued Sept. 8, and booking information returned by Sept. 22; officials reported $59,898.86 in costs as of Sept. 15. Full restoration, ransomware, data impact and attribution remain unresolved.

Woodhaven Lakes last documented server, internet and facility workarounds August 12. Ordinary facility, member and payment information was available by August 31 with no later outage report, supporting presumed resolution while Play's claim remains unverified.

Ransomware disabled Coweta, Oklahoma, computers, files and administrative services beginning August 5, 2026, disrupting City Hall transactions, building permits and in-person card payments while 911 and off-site systems remained available. By August 18, day-to-day operations and utility-payment channels were normal; limited internal restoration and plain-text utility bills remained but were not expected to affect public services. No later public-service impact was found by August 30, so the incident is presumed resolved while technical recovery and the data review may continue.

Waukegan Township said its email system was compromised, disrupting regular access and prompting a warning about malicious messages. Restoration was underway August 5, and no later evidence supports a specific continuing impairment or wider shutdown. The bounded incident is presumed resolved, although the exact recovery date, access vector, data impact and technical scope remain unknown.

Beaver County employees lost access to behavioral-health patient files during a ransomware incident later disclosed Aug. 4. Current service information and the absence of a later access problem support presumed operational resolution, while data and payment consequences remain open.

A cyberattack disrupted systems and delayed gate operations at North Carolina Ports facilities in Wilmington, Morehead City and Charlotte beginning August 4, 2026. Normal gate schedules returned August 6, and by August 18 the authority's ordinary customer tools and operating pages were available without a continuing delay warning, supporting presumed resolution. NC Ports has not published a technical all-clear or confirmed ransomware, data compromise or attribution.

JPS Health Network took systems offline after identifying suspicious activity August 3, disrupting technology, communications, records processing and care workflows across its hospital and clinics. Its core electronic health record returned August 14, ending an ambulance diversion and restoring clinics, laboratories, pharmacies and elective procedures; MyChart followed and routine operations resumed August 16. JPS has not disclosed malicious or unauthorized activity, ransomware, data impact or a responsible actor.

Sawyer Savings Bank closed all four Ulster County branches after an August 3, 2026, network disruption that it later called a likely data security incident involving a vendor vulnerability, while digital banking remained available. The bank reopened all branches August 10 after affected systems were restored and tested, though its investigation into possible data impact continued. A separate Storm claim provides additional cyber evidence but does not establish ransomware, actor responsibility or data theft.

The City of Norcross identified a ransomware incident on Aug. 1, 2026, that affected certain municipal computer systems and caused limited service disruptions. Most systems and services were operational by Aug. 28, but restoration remained underway; the affected services, data impact, ransom activity and responsible actor were not disclosed.

Rapid City said it quickly detected and contained an attempted cyber intrusion involving a municipal wastewater lift station. Officials reported that water and wastewater infrastructure remained safe, drinking water was secure, and no operational disruption occurred while the city investigated with CISA and other federal partners.

A cyber incident closed Southeastern Oklahoma State University's Durant campus July 30, July 31 and August 3, 2026. Ordinary operations later resumed. On September 10, the university said its investigation found unauthorized system access and possible copying of files, and it mailed individual notifications. Interlock's claimed data volume, responsibility and ransomware remain unconfirmed.

A July 27 cyberattack affecting UIS SCADA infrastructure cut remote monitoring for Alpena Township's water and sewer operator and required programmable logic controllers at multiple sites to be reprogrammed. Remote monitoring was restored and utility service remained safe, while the township considered replacing 15 older cellular modems; the access method, data impact and actor remain unknown.

A malicious cyberattack disabled computerized operating controls at Braham's municipal water plant on July 27, 2026, stopping the well and treatment plant for about two hours before crews restored operations without affecting drinking-water quality. Braham was among more than 30 Minnesota water-system attacks, but public attribution remained unresolved despite reports that anonymously briefed officials suspected Iranian hackers.

A July 27, 2026, cyberattack blocked remote access to the City of Cape May Water and Sewer Department's monitoring system, requiring manual controls until normal operations resumed July 28. The city manager said attackers did not change operational settings or take control, and officials said water service, drinking-water safety and customer data were unaffected.

Childersburg Water Works, Sewer, and Gas Board in Alabama took its automated controls offline after a July 27, 2026, cyberattack targeted a programmable logic controller. Manual operations kept water, sewer and gas service available while crews installed safeguards. The exact date automated operation resumed remains unestablished.

Intruders gained remote access to Coweta County Water and Sewerage Authority controls on July 27, 2026, changed passwords and disrupted automated control communication, prompting operators to switch to manual operation. Authority officials said water service, water quality and customer data were unaffected. No later operational impact was documented, and the incident is presumed resolved; the final automated-control restoration time and responsible actor remain unknown.

Clayton County Water Authority said unauthorized cyber activity may have caused or contributed to a July 27, 2026, disruption affecting operational systems and water service in north Clayton County. Water pressure was restored within hours, the precautionary boil-water advisory was lifted July 28 after negative water-quality tests, and CCWA said it found no evidence that customer billing or payment information was accessed or compromised.

Columbus Water Works detected and contained a cyberattack on July 27, 2026, affecting portions of its automated monitoring systems. Operators shifted to manual control, and officials reported no interruption to water service or drinking-water quality; the access method and responsible actor remain unknown.

A cybersecurity incident affected automated controls supporting Maple Plain's municipal water utility on July 27, 2026, but contingency procedures kept drinking water safe and water and wastewater services fully operational. Maple Plain was among more than 30 Minnesota water-system attacks; public attribution remained open despite reports that anonymously briefed officials suspected Iranian hackers.

Newton County Schools took affected systems offline after detecting unauthorized network activity, disrupting phones, email and other network services around the start of classes. The district said network services were restored August 6, although technicians were still validating remaining systems and applications. Qilin listed "Newton County School System" and the district's domain on its leak site August 28, but the claim remains unverified and does not establish encryption, data theft or actor responsibility.

Saber Healthcare Group reported that unauthorized corporate network access and file encryption caused an outage of some internal and external systems on July 27, 2026. A spokesperson later said internal systems returned within hours; inaccessible files were restored from backups within 24–48 hours. Its separately hosted electronic medical record system was unaffected, and no patient-care interruption was reported. Potential personal-information exposure remains under review; data theft and the threat actor are unconfirmed.

South St. Paul identified malicious activity affecting automated water-utility controls on July 27, 2026, but contingency procedures kept drinking water safe and water and wastewater services operating normally. The incident was among more than 30 Minnesota water-system attacks; public attribution remained open despite reports that anonymously briefed officials suspected Iranian hackers.

A July 27, 2026, cyber intrusion disrupted phone communications with Woodbine, New Jersey's municipal water system and required employees to reactivate and operate the system manually. Officials said water service continued, drinking water remained safe, no customer data was compromised and the system returned online without further issues.

A July 26 ransomware incident disrupted AnMed's network and patient care in South Carolina and Georgia. AnMed confirmed file locking and unauthorized copying, then announced full operations and restored MyChart functions Sept. 14. Patient-file review continues; HHS lists 501 affected individuals in the Aug. 27 report, not a final total. Interlock attribution remains medium confidence with a conflicting Gentlemen claim.

A cyberattack disrupted cellular communications at two Plymouth water towers and several wastewater lift stations overnight July 26–27, 2026, but crews maintained operations manually without affecting water levels, quality, or public services. Plymouth restored all impacted communications connections July 28 and returned the system to normal operations; attribution remained unresolved.

A cyberattack disrupted work email, internet access, Google Drive and ClassLink applications at Oceanside Unified School District beginning July 24, 2026. By August 18, the district had opened schools and was publishing routine first-day and school-program updates, supporting presumed resolution of the material disruption. Officials have not published a technical all-clear or confirmed affected data, ransomware, extortion or attribution.

City of Dallas security systems detected a possible threat originating outside the municipal network on July 20, 2026, and automatically took three public websites offline. The sites returned after more than 15 hours, while officials reported no network intrusion or loss of city data and said essential emergency, payment and permitting services remained available.

Sumner County Schools discovered unauthorized network access July 20, 2026, disrupting registration and delaying the first day of school from August 4 to August 10. By August 18, the district's website reflected ordinary post-opening school activity, supporting presumed resolution of the material disruption. Officials have not published a technical all-clear or confirmed affected data, ransomware, extortion or attribution.

Malicious traffic disrupted Tidewater Telecom and Lincolnville Communications internet service across coastal Maine beginning July 19, 2026, leaving some connections unusable and significantly limiting Damariscotta Town Office services. The providers reported near-normal service July 21, and their status page subsequently showed customer internet operational with no recurrence through July 26.

AngMar Management Services said an unauthorized actor accessed parts of its network in July 2026, and Teiss reported that some IT systems were disrupted. The federal health department lists 126,196 people affected, while an Indiana filing lists 110,256; the difference is unexplained. Neither the disruption's duration nor any effect on patient care has been established.

Coca-Cola confirmed that ransomware caused unauthorized access, data theft and a temporary suspension of fairlife production in the United States. Most production resumed July 27 while restoration continued, and no later operational impact was documented through Oct. 26. Anubis claimed it released engineering, production and HR material, but Coca-Cola has not verified the actor, alleged files, claimed encryption scope or one-terabyte volume.

Unauthorized network access July 16–27, 2026, accompanied a prolonged Kenaitze Indian Tribe computer and communications outage affecting health and public services. The Tribe began notifications Sept. 25 about possible exposure of personal and health information. Regular phone numbers resumed by Sept. 15, but full restoration and The Gentlemen's responsibility remain unconfirmed.

The Town of Milford, New Hampshire, confirmed unauthorized activity affecting municipal computer systems after phone, internet, clerk, billing, payment and meeting disruptions began July 15, 2026. On July 22, several systems remained offline for analysis, backup processes were still in use, and officials said the cause and full extent had not been confirmed. No later public evidence documented continuing operational impact or provided an authoritative all-clear, so the incident is presumed resolved.

Oklahoma Manufacturing Alliance said ransomware activity targeted two employee computers and affected a limited portion of its local network on July 15, 2026. Staff isolated the systems and restored access through a separate secure network later that morning, while OMA said it found no evidence of data removal or compromised client records.

TruStage's July 11 cyberattack disrupted insurance claims, payments and retirement services. Oct. 21 reporting documented continuing payment delays and backlogs alongside phased recovery. Full restoration, data compromise, extortion and attribution remain unresolved.

Virginia Peninsula Regional Jail discovered computer-system disruptions around July 14, 2026, determined it was a ransomware incident and later said operations had returned to normal without affecting facility safety or security. The jail said personal information may have been accessed or acquired, while INC Ransom separately claimed to have exfiltrated internal files; no misuse had been identified when the jail issued its notice.

A July 13 cyber incident disrupted Cedar Crest College applications, network drives, OneDrive and file sharing, with July 20 providing the last dated evidence of incomplete restoration. Required orientation and fall classes subsequently began without a located report of continuing material technology disruption, supporting presumed resolution while the exact recovery date remains unknown. The college has not confirmed data access or ransomware, and NightSpire's claim remains uncorroborated.

A large-scale distributed denial-of-service attack disrupted Greenfield Communications internet, television and phone service in Rancho Murieta and other California communities beginning July 12, 2026. Most customers were restored July 14, but IP-geolocation problems continued affecting streaming applications and some remote work through July 17.

Petersburg Borough said ransomware deployed on its network July 11, 2026, affected utility billing software. Its IT provider stopped the attack, but the duration of billing impairment, any data theft and the exact recovery date remain unresolved.

Progress Software traced its July 2026 ShareFile Storage Zone Controller shutdown to a high-severity path traversal zero-day affecting all 5.x and 6.x versions and initially released versions 5.12.5 and 6.0.2. The containment action disrupted access to customer-managed files until July 14, but Progress said it had no indication of unauthorized access to customer accounts or data and had identified no active threat.

A July ransomware attack shut down Greene County, Georgia, systems and disrupted payments and public requests. An Aug. 17 county notice confirmed copied data, potentially including employee identifiers, and said services had been restored; the exact recovery date remains unknown.

The St. Lucie County Clerk and Comptroller's externally hosted public website was compromised July 7, 2026, causing an hours-long homepage outage and redirecting some links to an unauthorized third-party site. Staff removed a malicious script and restored the site from a known-good backup; the clerk confirmed the compromise July 8, reported no evidence of access to internal systems or their data, and warned of possible slower performance during database re-indexing.

Pennington County's July 4, 2026, ransomware incident forced office closures and restricted administrative services. Online property-tax payments returned Oct. 2, and Oct. 5 reporting said nearly all services were back online after a network rebuild. Full restoration, data impact and actor identity remain unresolved.

Jacksonville, Texas, detected suspicious network activity July 3, 2026, took affected municipal systems offline and used workarounds while some online services were unavailable. By August 3, the city website and payment services were operating, its alert center reported no active alerts and no later impact was found, so operations are presumed resolved. A Sept. 17 notice confirms unauthorized access and possible file viewing or copying; ransomware and attribution remain unresolved.

Vista Del Mar Child and Family Services took its network offline after detecting suspicious activity on June 30, 2026, and later determined that an unauthorized actor accessed certain systems. The Los Angeles nonprofit said it remained operational and continued scheduled services while reviewing files that may have contained personal and protected health information. HHS lists the event as a hacking or IT incident affecting 500 people, and the public record does not identify the actor, access vector or ransomware.

Salida School District's June 29 cyberattack damaged local files and disrupted Central Office work. At the Sept. 15 board meeting, the superintendent reported attack-related delays to building-automation implementation. No complete restoration notice, ransomware confirmation or actor attribution has been found.

DCHA discovered a cybersecurity incident June 28, 2026, shut down its network and restored services in phases. It confirmed compromised sensitive information July 17 and announced normal operations for every department beginning July 20; no later disruption was found by August 3, so operations are presumed resolved. Interlock's ransomware and 1,660 GB theft claim remains unverified.

Delaware County, Pennsylvania, detected anomalous network activity June 26, 2026, and took its network offline after remote attackers accessed the network and county-maintained data, disrupting phones, servers, financial software, libraries and other public services. The county did not publicly acknowledge cyber involvement until July 2; an earlier Sheriff's Office explanation that called the outage a provider disruption was inconsistent with the county's later account of detecting and containing the intrusion June 26. The county restored operations using secure backups, while potential exposure of sensitive data remains under review.

American Color Imaging experienced a systems outage from June 24 to July 1, 2026, that paused production, held submitted orders, delayed customer communications and disabled an ordering platform. Settra publicly claimed on July 16 that it stole 653 GB of data, but ACI has not confirmed a cyberattack, unauthorized access, data theft or the actor's involvement.

Akron Public Schools detected and contained a June 23, 2026, cyber incident that caused a districtwide network outage and closed every district building June 24. Most programs, offices and athletics were scheduled to resume June 25, but online credit recovery remained canceled through June 26 while external specialists investigated the incident's nature and scope.

The Wise County Sheriff's Office said hackers hit its systems twice during the week before June 22, 2026, preventing records retrieval and printing of incoming public-information requests. Logged and saved requests were lost or inaccessible and had to be rebuilt from sent email files. The deadline suspension ended July 5 and official request channels are currently available, but full restoration and recovery of missing requests remain unconfirmed.

University City, Missouri, confirmed that malicious cyber activity caused a network outage first publicized June 17, 2026, disrupting permitting, public-record access, card processing and online bill payment. On August 6, the city said affected systems and services had been restored and that its investigation found no evidence personal information was accessed, removed or compromised.

River Financial Corporation confirmed unauthorized access, ransomware deployment and removal of data from its network, including River Bank & Trust. A July 30 SEC amendment said River attempted to suppress the affected data and obtained the threat actor's representation that the stolen data was deleted. River did not say deletion was verified or disclose a ransom payment, and the affected information and potential materiality remain unresolved.

NAIC’s PeopleSoft intrusion involved data acquisition and publication and disrupted investment designations and invoice payments. Rating feeds resumed in August, and regular FE/PLR designation publication restarted Aug. 17. Operations remain presumed resolved; the online-invoice recovery date and conclusive actor attribution remain unknown.

Prince George County, Virginia, said a June 11, 2026 cyber incident disrupted phones, internet and online payments before systems were secured and normal operations resumed. The county said personal data may have been accessed and offered identity monitoring, while RansomHouse's ransomware and attribution claims remain unverified.

Spartanburg County isolated portions of its network after detecting questionable activity on its computer infrastructure June 10, 2026, disrupting phones, courts, payments and records for nearly three weeks. Officials never publicly labeled the event a cybersecurity incident or confirmed malicious access, but the county's system-activity and security-response wording provides concrete cyber evidence under registry criteria. Core connectivity returned June 29, and operations are presumed resolved.

Onslow County Schools detected unauthorized criminal activity June 9, 2026, disrupting phones, internet, digital services, testing and graduation livestreams across the district. The district later said a relatively small portion of data was exfiltrated; by June 23 the attack was contained and major services were returning, but staged infrastructure restoration and the data-impact review remained underway.

The City of Acworth, Georgia, documented network outages and possible service interruptions June 8, 2026, then confirmed June 18 that a cybersecurity incident had affected certain computer systems and that all systems were restored. INC Ransom later claimed the city, alleged possession of municipal data and threatened release, but Acworth has not confirmed the actor, data theft, ransomware, a demand or payment.

A June 7, 2026, ransomware attack disrupted Evanston Township High School District 202's phones, internet and safety systems, forcing a two-day campus closure. The Illinois school reopened June 10, but students reported transcript, connectivity and digital-ID difficulties in October. The responsible actor, personal-data impact and exact date of full technology restoration remain unresolved.

Lewis Brisbois Bisgaard & Smith LLP restricted outside access to internal networks after a June 2026 cyberattack and directed remote and hybrid employees to work from offices or use firm-issued computers. The public record does not establish whether attackers successfully entered the network, accessed client or employee data, deployed ransomware, made an extortion demand or caused a client-service outage.

YouLend US LLC detected a disruption to its computer network on June 9, 2026, and determined that an unauthorized party accessed the network from June 5 through June 9 and acquired files containing personal information. A later Texas attorney general record listed 2,826 affected Texans and exposure involving names, Social Security numbers and financial information. The company secured affected systems and notified authorities; no threat actor or extortion demand has been confirmed.

Kittson County reported a cyber incident involving its emergency-services network, prompting Minnesota IT Services to block the county’s access to state motor-vehicle systems as a precaution. Full DMV services were temporarily unavailable while limited tab payments and Department of Natural Resources transactions continued; emergency services remained operational, and ransomware, data theft and NightSpire attribution were unconfirmed.

Bowman Parks & Recreation disclosed at a June 2, 2026, city commission meeting that a cyberattack encrypted every department file and connected thumb-drive backups, making the records inaccessible. The files were later decrypted with outside expert assistance, but the attack date, initial access method, ransom or payment status, data-copying scope and public-facing service impact remain unresolved.

Nacogdoches County identified a phishing-related cybersecurity incident on May 28, 2026. Online pay-stub access was unavailable and paper stubs were in use July 1 while payroll and other county services continued; no newer operational-impact evidence was found by August 3, so the disruption is presumed resolved. A Texas AG listing reported 1,100 affected Texans.

Chelan County, Washington shut down government networks, computers and telephone systems after detecting malware on May 24, 2026. Email, phones, records access and other county functions remained disrupted for weeks, and the Clerk's Office later reported a backlog exceeding 6,000 documents as systems were restored.

Unauthorized access to Educational Testing Service systems exposed California student records and disrupted enrollment processing and some assessment activities. The assessment program marks the processing issue resolved Oct. 20, 2026. Breach notifications, identity protection and investigation continue.

Alexandria, Tennessee temporarily shut down Town Hall and police computers after fraudulent purchases were discovered in the town's Amazon account. The town later said only that account was affected and no public information was compromised or delayed; in June, aldermen approved five replacement computers and a managed-security service.

A cyberattack affected certain Commonwealth of the Northern Mariana Islands government email accounts on the cnmi.gov and dof.gov.mp domains, leaving some users without access. The Office of Information Technology initiated systemwide security protocols and corrective actions, but officials did not disclose the attack method, number of affected accounts, data impact, or final restoration date.

Delano Public Schools canceled classes May 20 after ransomware compromised its network; students returned the next day with limited connectivity. On June 10, the district said effects continued, old file folders were compromised through a firewall, and student and staff data was not compromised, narrowing an earlier statement that district data was likely stolen. LockBit claimed the attack and demanded $1.2 million, which the district said it did not pay.

The Scottsboro Police Department in Alabama said it detected and stopped an attempted cyberattack targeting department servers. Officials reported no evidence that police reports, photographs, videos, identifying information or other sensitive data were accessed, exported or compromised, and no service disruption was documented.

Chanhassen Dinner Theatres in Minnesota took systems offline after detecting a cyberattack on part of its network on May 15, 2026. Phone, computer and food-and-beverage systems were disrupted, and the attack came with a ransom note; performances were canceled or rescheduled before reopening May 21 on a temporary system. Current official ticketing information again lists normal payment and gift-card redemption options, supporting resolved status, while encryption, data theft, payment and attribution remain unconfirmed.

Krum Public Library confirmed that a May 14, 2026, ransomware attack disrupted computer access, printing and Wi-Fi and temporarily limited checkout to five items. The library later secured its network, and current official pages again advertise normal services; unauthorized file access was confirmed, while NightSpire's claim to have stolen 50 GB remains unverified.

Boyne City, Michigan, experienced a cybersecurity incident May 11, 2026, that disrupted municipal computer access, email, utility billing, online payments and account-history functions. By July 31, online payments had returned and delayed billing had resumed, although staff were still restoring billing history and catching up on billing cycles; no later continuing service impact was found by August 30. The Gentlemen later claimed the city, but Boyne City has not confirmed the actor, ransomware or data theft.

Mountain Park, Oklahoma, identified unauthorized access to municipal systems on May 11, 2026, and requested assistance from the Oklahoma State Bureau of Investigation. The town said administrative email was disrupted, while emergency services and utility operations were not interrupted; the access method, responsible party and possible copying of municipal data remain unresolved.

Malicious code on Stack Sports' Sports Affinity checkout pages captured payment information entered from about May 8 until residual elements were cleared June 22, 2026. Stack Sports notified affected users after finalizing its transaction review July 17; the exposed fields may have included cardholder names, card numbers, expiration dates, CVVs and some checking-account numbers.

Allegany County Transit said a cybersecurity incident involving a third-party scheduling vendor required riders with May 6–7, 2026, pickups to call and confirm their trips. Public evidence points to IT Curves as the likely vendor, while Ababil of Minab separately claimed it compromised IT Curves and wiped and stole data; neither the vendor link nor the actor’s technical claims were confirmed.

West Pharmaceutical Services detected a cyberattack on May 4, 2026, in which an unauthorized party exfiltrated data and encrypted systems. The company took systems offline globally, disrupting manufacturing, shipping, receiving, and enterprise operations before reporting full operational restoration on May 20.

Exploitation of CVE-2026-41940 compromised Government of Guam web infrastructure and disrupted access to agency websites, downloads and public documents beginning in May 2026. The Bureau of Statistics and Plans later removed its restoration warning and repopulated report and data pages; the incident is presumed resolved because no territorial government all-clear establishes the exact recovery date.

A coordinated cyberattack forced the San Diego Community College District to shut down network systems, disrupting internet, Wi-Fi, websites, file servers, transcript processing, instruction and student services across San Diego City, Mesa, Miramar and Continuing Education colleges. Miramar directly confirmed the attack, while districtwide restoration proceeded by college and concluded with normal service status on May 15. The district said protected data was not compromised, and the public record does not establish ransomware or a threat actor.

DysruptionHub first reported Foxconn's multi-day Wisconsin network and production outage on May 5, 2026, before any other news publication identified in the reviewed chronology. Foxconn confirmed seven days later that a cyberattack affected some North American factories and said production was resuming, although workers at Mount Pleasant still described a slow, partial recovery. Nitrogen's claim of stealing approximately 8 TB of data remains unverified, and Foxconn has not identified every affected factory.

Kentwood Public Schools said a student used malicious software designed to disrupt its system, causing Wi-Fi connectivity problems throughout the Michigan district. Police investigated, outside experts helped isolate the issue, and the district said the technology problems appeared to have been resolved.

Instructure confirmed two related Canvas intrusions that exposed user, enrollment, course and message data and prompted a platform-wide outage May 7, 2026. Canvas returned to normal service, and the final incident-related Free-for-Teacher retrieval window ended July 29; continuing data review and notifications are breach-response activities rather than an ongoing service disruption.

Advanced Diagnostic Imaging, P.C., doing business as AdvancedHEALTH, said it detected suspicious activity on April 28, 2026 and determined that an unauthorized actor gained access to information on its systems. Columbia Surgical Partners had separately described ransomware at its parent and loss of EHR access. AdvancedHEALTH's June notice said its data review was ongoing and found no evidence of misuse; DragonForce's claimed 390 GB theft remains unverified.

Murray County, Georgia closed or limited several government offices after a ransomware attack disrupted county computer systems on May 13, 2026. County officials later said most systems had been restored and that the county paid $200,000 to prevent attackers from publishing county data, while 911, public safety, and voting remained available.

Kent District Library disclosed a ransomware event after a computer outage beginning April 24, 2026 closed all 22 branches and disrupted public access to computers, printing and other services. Most services were restored by July 9, but KDL still reported limited printing and unavailable gaming labs while recovery work continued.

Harrison County, West Virginia, discovered ransomware-related computer disruptions around April 23, 2026, affecting courthouse services, tax payments and administrative functions while public-safety and election systems remained intact. Operations later returned to normal, but the county warned that personal information may have been accessed; SafePay claimed responsibility and data theft, but the county did not confirm the claim or resulting exposure.

Cherry Health experienced organizationwide technology issues in April 2026 that disrupted its phone system while clinics remained open. The provider later confirmed unauthorized access and copying of network data, and HHS listed the breach as a network-server hacking incident affecting 501 people.

A ransomware attack that Adams County officials said began April 17, 2026, disrupted county networks, digital court and public records, vehicle registration, and noncash payments while the sheriff's separate systems remained available. Most county IT was restored by early May, but vehicle-tag services were still unavailable on May 19; no ransom demand, data-theft finding, responsible actor or final restoration date was publicly established.

Tallahassee officials confirmed an April 17, 2026 cyberattack affecting parts of the city's technology environment, and the public website became unavailable that afternoon. City staff said they isolated the threat and initially found no operational impact, while Leon County disconnected a shared network link as a precaution and warned of possible outages in linked applications.

Maryland took the Department of Assessments and Taxation's statewide Real Property Search application offline after detecting suspicious server activity April 14, 2026, directing users to local assessment offices during the outage. The state restored and cleared the tool for public use April 27 after testing found no evidence of a broader compromise.

The City of Palouse, Washington restored its public website from a hosting-provider backup after officials said the site had been hacked. Some recently added content was missing and required re-entry, while the city reported that no sensitive data was involved.

Clinton County, Iowa, took portions of its network and internet connectivity offline after monitoring detected unusual activity consistent with the early stages of an attempted internet intrusion. The county said the threat was contained, all critical systems and services were restored by April 16, 2026, and later forensic findings showed no county data was accessed or extracted and no systems or records were damaged.

Spring Lake Park Schools discovered on April 12, 2026 that an outside actor had accessed district systems and shut systems down to contain further access. Classes were canceled for two days, along with child care and community programs, while the district restored phones, building security, fire-protection and other safety-dependent technology.

Signature Healthcare detected suspicious network activity on April 6, 2026, and shifted affected Massachusetts operations to downtime procedures. Brockton Hospital diverted ambulances, chemotherapy appointments were canceled, pharmacies could not fill prescriptions and electronic records services were impaired before staged restoration concluded later in April.

The Standard-Examiner in Ogden and Daily Herald in Provo, both owned by Ogden Newspapers, reported significant production difficulties that disrupted Monday and Tuesday newspaper printing and delivery in early April 2026 while their digital editions remained available. Qilin later listed only the Standard-Examiner on May 2, but neither newspaper has confirmed ransomware, data theft or a connection between the claim and the shared printing disruption.

Minidoka Memorial Hospital’s April cyber incident limited imaging and prompted some emergency-patient transfers while care continued. A Sept. 24 regulatory letter confirms ransomware and notification of 21,931 Idaho residents, without confirming file theft or Blackwater’s claims.

Karl Auto Group discovered on April 4, 2026, that an unauthorized third party had accessed business systems, disrupting phones and computers across its Iowa dealership operations. The company said files may have contained sensitive customer and employee information, while RansomHouse separately claimed Karl Chevrolet and alleged encryption; ransomware, exfiltration and a connection to that actor remain unconfirmed.

Chevin Fleet Solutions took affected U.S. and U.K. FleetWave environments offline after disclosing a cybersecurity incident on April 2, 2026, causing a major service outage for fleet-management customers. Missouri's state fleet system became unavailable and required phone workarounds, while Chevin later confirmed unauthorized access to customer databases containing operational and personal information.

Uplink documented a cybersecurity event that disrupted BAT-MINI alarm signaling and interactive services used by dealers and monitored accounts across the United States from April 2 to April 4, 2026. The M2M Services-owned brand restored all BAT-MINI services by April 4 but did not disclose the event’s cause, affected-account count, data impact or a responsible actor.

Belgrade School District in Montana confirmed that malware affected systems in its network after technology problems began in early April 2026. The incident disrupted routine school functions, including lunch processing and assignments, while restoration continued and the district reviewed whether student or staff information outside Infinite Campus was affected.

Gritman Medical Center described an electronic-systems outage that closed multiple outpatient clinics beginning April 1, 2026, while its hospital and emergency department remained open. Clinics reopened April 6, although four rural sites still had phone outages; the provider called the event a cybersecurity incident but reported no successful system access or known patient-data compromise in its preliminary findings.

The City of Anthony reported missing public records, inaccessible systems and wiped police devices after a change in administration, limiting normal municipal records work. DysruptionHub assesses with medium confidence that the incident involved insider activity and digital information destruction, although the public record does not establish who acted or whether the actions were authorized.

A ransomware attack discovered March 31, 2026, directly affected the Patriot Regional Emergency Communications Center and the Town of Pepperell, disrupting Pepperell's network for about one week and non-emergency public-safety phone service across PRECC's five member towns. PRECC is a joint regional service administered day to day by Pepperell and governed by representatives of Ashby, Dunstable, Groton, Pepperell and Townsend; it is not a separate municipality. 911 and emergency response continued, and available evidence does not show that the other four towns' municipal networks were compromised.

Hasbro identified unauthorized access to its network on March 28, 2026, took certain systems offline and used business-continuity measures while restoring operations. The incident disrupted order processing, shipping and invoicing throughout the second quarter, with Hasbro estimating an approximately $25 million revenue impact before returning to pre-incident practices.

The City of Martinsville, Virginia, detected a cyberattack March 25, 2026, that disrupted computer systems and delayed or limited services in the municipal building. City Manager Robert Fincher said April 9 that city services were fully operational. A later city notice said personal information might have been accessed but reported no evidence of misuse.

Ransomware disabled the Jackson County Sheriff's Office network in Indiana in March 2026, leaving computers, Wi-Fi and the police-report system inaccessible. Dispatchers shifted to Seymour Police Department computers, officers wrote reports in Word documents and technicians rebuilt the environment while officials said the county would not pay a ransom.

North Attleborough Public Schools detected unauthorized network activity on March 25, 2026, and later shut down districtwide internet access as a precaution. The outage disrupted communications and limited classroom technology access, but instruction continued and officials said all network connectivity was restored by April 1.

Ransomware disrupted internet, Wi-Fi, Gmail and Google applications across Alamo Heights ISD from March 23 to March 27. The district later said personal information was accessed and potentially downloaded, affecting 26,629 people, and said no ransom was paid. WorldLeaks and Qilin posted separate victim listings, but the conflicting claims do not establish who caused the incident.

Puerto Rico security monitors detected and neutralized a cyberattack attempt against DTOP on March 23, prompting officials to disconnect systems and pause CESCO appointments across the territory. CESCO centers resumed regular operations March 26 except Utuado, which still required additional validation. Officials said resident information remained secure, and no stable public actor claim was identified.

The Town of Colebrook said a municipal email account was hacked, prompting New Hampshire to suspend state-system connections serving the Town Clerk's Office and dispatch. The disconnection interrupted vital-records, election and DMV access; vital records and election functions were restored by March 27, 2026, while DMV and dispatch reconnection remained pending.

An intruder accessed an Infinite Campus employee's Salesforce account March 18, 2026, prompting precautionary service restrictions and an extortion response. Have I Been Pwned later indexed published data containing about 137,100 unique email addresses and school-staff information. The service disruption remains presumed resolved; ShinyHunters attribution remains qualified.

Mile Bluff Medical Center disclosed an April 2026 security event involving data encryption that disrupted phone and computer functions and forced clinical teams to use downtime procedures while patient care continued. A later breach notice said an unauthorized actor had accessed the network from March 18 through April 19 and copied files, while the electronic health record was not affected.

San Felipe-Del Rio CISD detected suspicious email activity March 18 before internet, phones and other in-network communications and data systems went down. Schools, classes and transportation continued. WorldLeaks later listed the district, but the claim does not prove ransomware, data theft or actor responsibility; the incident is presumed resolved.

Clayton detected suspicious network activity on one system March 18 and manually took its network offline, limiting phones and online services during restoration. By March 23, investigators said attempted data access was unsuccessful and found no evidence that customer or employee data was compromised. No stable public actor claim was identified, and no later continuing impact was found.

Pro-Iran imagery and a Farsi control message replaced the Yeshiva World News homepage March 18, interrupting access to the outlet's website and articles before it displayed a maintenance page. The website later resumed normal publishing. No stable actor claim or evidence of ransomware or extortion has surfaced, leaving attribution unresolved.

LA Metro restricted internal administrative systems after detecting unauthorized activity March 16, disrupting arrival information and some TAP fare-loading channels while buses and trains continued operating. Ababil of Minab claimed the intrusion; later technical research found LA Metro data on infrastructure tied to the operation, supporting high-confidence attribution and data theft but not the actor's claimed destruction or exfiltration volumes. The incident is presumed resolved because no continuing operational impact has been documented since April 2.

A security incident prompted Lucas County to take systems offline in mid-March, disrupting the AREIS property-records portal and dog-licensing service. Public-facing systems were accessible again and AREIS was restored March 17, supporting resolved operational status, while the cause, data impact and actor remain undisclosed.

At Sage Water Resources' Duchesne, Utah, saltwater-disposal facility, an attacker altered PLC safety logic on March 15, 2026, bypassing shutdown protections and leaving pumps running dry while the control system showed normal operation. A truck driver spotted the mismatch; workers shut down automation, continued receiving wastewater under manual control, and avoided pump failure, service interruption and environmental harm. Sage said a contractor rebuilt and verified the safety logic and restored continuous operation within days.

A cyberattack disrupted network resources used by Goodwill Industries of Greater Grand Rapids at 18 stores across six western Michigan counties in March 2026, forcing cash-only sales while the nonprofit rebuilt its point-of-sale program. An Interlock listing contained material appearing to identify the regional affiliate despite an incorrect Pennsylvania label, but Goodwill did not confirm ransomware, data theft or attribution.

A March 14 cyberattack led Intoxalock to pause systems supporting installations, calibrations, account access and service centers across its nationwide network. Some drivers could not start their vehicles, and two named shops reported blocked work; Intoxalock said core services resumed March 22. State agencies addressed compliance consequences, but no agency outage was documented, and ransomware, attribution and data theft remain unconfirmed.

Minot officials said ransomware affected a Water Treatment Plant SCADA server March 14, 2026, prompting isolation and about 16 hours of manual monitoring before a backup restored local visibility. A connected Northwest Area Water Supply system returned to full operation March 17, but its data link with Minot remained disabled May 20 while water safety, pressure and customer service remained intact.

Ransomware disrupted the DeKalb County Sheriff's Department and jail server March 13, interrupting email and inmate booking. Booking data was recovered that evening, but the public record does not provide a full restoration date, identify the ransomware family or establish data theft.

Duffy’s Sports Grill experienced multi-day card-payment and MVP loyalty disruptions at multiple Florida restaurants beginning by March 13. Customer reports also described cash-only service, a manual card workaround, event cancellations and at least one temporary closure. Qilin’s March 14 listing remains a low-confidence attribution claim, and no later continuing impact was identified, so the incident is presumed resolved.

Winona County’s separate spring ransomware incident involved network access March 13-April 7, system disruption in April and Minnesota National Guard assistance. Critical systems were restored by April 24. An Oct. 8 notice confirms copied county data and sensitive identity, financial, medical, law-enforcement and biometric information; the affected-person count remains undisclosed.

A March 2026 network intrusion disrupted Aroostook Mental Health Center connectivity and business operations across its service area in Aroostook, Hancock and Washington counties. Qilin claimed the organization on March 24, and AMHC later confirmed that an unauthorized actor accessed its network on March 11-12 and copied files containing personal information. The federal breach portal lists 501 affected people, while the Maine filing leaves the total undetermined.

Hanover County Public Schools lost divisionwide internet access and multiple systems after a malicious actor accessed network data and attempted to deploy ransomware in March 2026. Instruction continued without normal technology until internet and core platforms began returning March 18. HCPS said personal information may have been viewed or accessed, but it reported no indication of misuse and did not identify the actor.

A March 11 destructive cyberattack wiped about 40,000 Stryker laptops and disrupted its Microsoft environment, global manufacturing, order processing, shipping and some customer procedures. Handala claimed the attack; federal authorities later said an Iran intelligence ministry-controlled Handala domain was used to claim the operation, supporting high-confidence attribution, while the actor's 200,000-device and 50 TB theft assertions remain unverified. Stryker said its manufacturing, commercial, ordering and distribution systems were restored by April 1. Later reporting described residual peripheral vascular supply constraints into September.

Unauthorized access to a CareCloud EHR environment March 10–16 disrupted functionality and data access for about eight hours March 16 before restoration. Forensics confirmed exfiltration; HHS now reports 3,756,469 affected individuals, including a revised Texas filing identifying 270,529 Texans. Ransomware involvement and the responsible actor remain unresolved.

A cybersecurity incident affected portions of Rusk County’s network and led the county to engage forensic specialists while restoring safe, remediated systems. Qilin later claimed the March incident at low confidence because the county did not corroborate attribution; a Lynx listing concerned a separate November 2025 outage. The dated effects are older than 30 days with no continuing outage identified, supporting presumed-resolved status.

Belhaven University took portions of its internal network offline March 6 after identifying a cybersecurity incident. Some services remained unavailable March 18; most student services were operating normally and online classes were scheduled to resume March 19. No final all-clear was published, supporting presumed-resolved rather than resolved status.

Passaic County said a March 4 ransomware event made its network, phones, computers and internet inoperable, and the county later said most operations had been restored. Medusa claimed responsibility and threatened to publish data, but the county did not confirm the attribution or the scope of any data access.

Alcorn School District disabled its network March 1 after suspicious activity disrupted certain systems and threatened scheduled testing. LockBit later claimed the Mississippi district and demanded an undisclosed ransom, but the district did not confirm ransomware, actor responsibility, encryption or data theft. No later operational-impact notice or formal restoration statement was found, and the incident is presumed resolved.

Vivian’s Door, a Mobile, Alabama, nonprofit, took its systems offline for three days in March 2026 after suspicious activity and emails impersonating the organization. Executive Director Janice Malone told The Verge the shutdown interrupted business and left an approximately $3,000 response bill; possible exposure of stored financial data remains unconfirmed.

Ransomware detected March 19 disrupted Foster City's municipal services, with staged recovery continuing in April. A later city notice confirmed unauthorized access from Feb. 28 to March 25 and possible viewing or acquisition of personal-information files; no actor or final restoration date is established.

A cyber-related IT disruption that LCCC said began February 27 closed all four sites March 4 and moved classes online. Campuses reopened in stages by March 23, but Wi-Fi and telephone effects continued into April. Medusa claimed LCCC on March 17, and a secondary tracker reported a $100,000 demand and alleged exfiltration, but the claim does not establish ransomware deployment, data theft or Medusa responsibility.

Attackers encrypted Peak Software Systems infrastructure, backups and internal systems supporting the Sportsman platform, disrupting municipal recreation registration, reservations, rentals and payments in at least six cities. Lehi City later said an unauthorized party accessed systems and that certain Legacy Center files may have been accessed or acquired. Services were restored, the incident was contained and no stable threat-actor claim was found.

Wagon Mound Public Schools said a virus shut down district internet and networked computers around February 26, 2026, while its insurer worked to restore systems and staff and student devices were collected for scanning. Interlock listed the district March 9 and claimed it obtained about 80 GB of staff and student information, but the district has not confirmed ransomware, the actor or data theft. March 3 remains the last dated evidence of disruption, supporting presumed-resolved status without establishing an exact recovery date.

Ohio County Schools disabled district internet after detecting evidence of a potential cybersecurity attack Feb. 24, disrupting connected learning and administrative work for nearly a week. The district reported full functionality March 2 and said it had no evidence that student or employee data was at risk; the mechanism and actor remain unresolved.

NewspaperArchive said an unauthorized third party remotely accessed and encrypted systems hosting its historical-newspaper platform in February 2026, making the service unavailable to libraries and subscribers. Core search and download functions returned during a phased recovery, but some publications and personal accounts remained unavailable as of May 19.

A ransomware attack struck the University of Mississippi Medical Center on Feb. 19, 2026, disabling Epic records, phone and email systems and closing 35 clinics across 23 Mississippi municipalities. Clinics and phone service returned March 2 after nine days, while Medusa later claimed the attack and demanded $800,000 to prevent publication of allegedly stolen data.

A technology outage closed Town Hall, Public Works and Community Development offices in Orange, Virginia, for parts of three days in February 2026 and temporarily limited Town Hall payments to cash or checks. LockBit listed `townoforangeva.gov` on its leak site March 5, providing concrete external cyber evidence but not proving that ransomware caused the outage, that data was stolen or that the town confirmed the claim.

Huntington, West Virginia, detected suspicious activity on February 17, 2026, and isolated municipal systems during a cybersecurity investigation. A limited number of internal systems were affected and normal operations returned February 19; Termite later claimed the city, but the listing remains uncorroborated.

Livingston HealthCare disclosed a potential cybersecurity incident on February 13, 2026, after phone and network services were disrupted and some systems were taken offline. Phones returned February 16, but staff still could not use the patient portal February 18; the final recovery date and possible patient-data compromise remain unresolved.

Ransomware locked computer systems at the Virgin Islands Economic Development Authority by Feb. 12, 2026, and prompted a demand exceeding $300,000. Officials investigated whether beneficiary tax records were exposed; no actor, payment or confirmed data theft has been disclosed, and later board activity showed some operations had resumed without establishing an exact restoration date.

A cyberattack disrupted the State College Borough network Feb. 11, 2026, delaying email responses and closing the Centre Region Council of Governments building, which depended on borough IT services. Borough offices, phones and public-safety services remained available; the exact restoration date was not disclosed.

Meriden's municipal network shutdown disrupted payments, records, meetings and library services. Later city breach notices identified ransomware and possible exposure affecting 2,325 Connecticut residents; INC Ransom attribution remains unconfirmed.

Cocoa experienced an IT disruption after an external-system breach spanning February 8-16, 2026, disrupting phones, payments and municipal workflows while emergency and water operations continued. The city initially described the event only as "technical issues," then notified 896 people of hacking June 4, 107 days after its first public operational disclosure and 101 days after INCRansom claimed the city. The claim remains unconfirmed, and some system restoration was still underway March 10.

A ransomware attack disrupted BridgePay payment services beginning Feb. 6, 2026, affecting merchants and municipal billing. BridgePay said gateway instances were restored by Feb. 28, though partner connections took longer; Lightspeed reported one connection still unavailable March 4 and restored March 10.

A Pinellas County arrest affidavit alleges that a former Clearwater Public Library System technology employee used a library administrative account on February 5, 2026, to remove Deep Freeze security software from about 200 public computers. The action led the city to shut down patron computers at three Florida library branches, while the accused employee pleaded not guilty and no theft, fraud or misuse of personal information was alleged.

Tulare City School District investigated suspicious cyber activity that disrupted computer systems and phone service in early February 2026. Phones were restored by Feb. 10 and broader system recovery was nearing completion; ransomware, data theft and SingularityMD attribution remain unconfirmed.

Denmark School District lost internet across its facilities for five school days beginning January 30, requiring paper-based instruction and administrative workarounds. The district later acknowledged a potential data security incident; teachers said at least 60 current and former employees were affected and alleged that the district received a ransom note, while INC Ransom separately claimed encryption and theft of about 71 GB. The district did not corroborate the actor's claims or link reported employee tax fraud to the incident, and the documented internet disruption ended February 5.

A security incident affecting CloudCone's Budget VPS platform in Los Angeles executed an unauthorized management-layer script, displayed ransom messages and made affected virtual-server disks irrecoverable. CloudCone restored the affected platform Feb. 11, 2026; other regions and service platforms were not affected.

Ransomware disrupted New Britain municipal systems Jan. 28, forcing manual workarounds while emergency services continued. Later breach-notice reporting identified possible personal-data exposure affecting 10,339 Connecticut residents.

The Town of Edisto Beach disclosed a potential cybersecurity incident involving email on Jan. 22, 2026. The town later said the event was an isolated cyber fraud scheme that caused an undisclosed financial loss, nearly 89% of which was recovered, with no resident or customer information compromised.

Winona County's January 2026 ransomware attack disrupted phones, internal systems, records access and county services. Recorder's-office recovery work continued March 12. The county later confirmed data theft affecting 6,196 people and a $128,539.57 ransom payment; officials said insurance covered about $50,000 and the county levy about $78,000.

Ransomware encrypted Community College of Beaver County systems March 9, closing the main campus and disrupting classes, account access and academic and financial records. CCBC later said an unauthorized party accessed its systems from January 16 through March 9 and obtained information that may have included names, Social Security and passport numbers, and financial account information with credentials. The college returned to full operational status March 30; Interlock's separate claim of responsibility and 780 GB of stolen data remains uncorroborated.

Midway, Florida, officials confirmed ransomware involving the police department’s SmartCOP records system in January 2026. The incident disrupted access to records and delayed public-records requests while investigators assessed possible data impact.

Anchorage Police Department shut down certain servers and disabled vendor access after learning Jan. 7, 2026, that a software provider involved in an upgrade had been attacked. APD found no evidence its systems were compromised or its data acquired.

Beacon Mutual detected unauthorized access Jan. 14, 2026, disconnected systems and restored production Jan. 20. The company later confirmed that files containing Social Security numbers and other sensitive information were copied; INC Ransom separately claimed responsibility and 275 GB of data.

Oakland Community Unit School District 5 detected unauthorized access during the 2025-26 winter break, contained the attack and restored systems from backups before students returned. Attackers demanded payment, but the district did not pay and reported no operational disruption or known sensitive-data impact.

Ransomware disrupted Metro Pet Vet and Manheim Pike Veterinary Hospital in Lancaster County, Pennsylvania, in January 2026, blocking access to a shared server and patient records at three clinics. Staff used paper records and a scheduling app while continuing urgent and scheduled care; data access or theft and the threat actor remain unresolved.

An attempted cyber intrusion identified about Dec. 8, 2025, led the Cheyenne and Arapaho Tribes to take systems offline, disrupting government communications and education administration. Rhysida later claimed the incident and demanded 10 bitcoin; ransomware deployment and data theft remain unverified.

Milton, Florida, detected suspicious activity consistent with ransomware on December 26, 2025, and secured its network. Utility billing, automatic payments and online payment services were disrupted into spring 2026, while investigators reported no evidence that city information was taken.