Cyber Incident Registry

A cyber incident disrupted internet and telephone service for the City of North Platte and Lincoln County governments in Nebraska on Oct. 9, 2026. County offices and the courthouse closed early, while officials said 911 and emergency services remained operational and systems were being secured.

U.S.NEXT said a cyberattack disrupted its website and email services on Oct. 9, 2026, affecting Madison County, Mississippi's website and online access. The provider expected a multiday interruption and offered to help customers redirect email; the attack method, full client impact and restoration remained unconfirmed.

The Maryland State Department of Education took its website offline as a precaution during a cybersecurity investigation, according to an Oct. 7, 2026, report by Chris Papst quoting the department. A streamlined replacement site provided an alternate access channel, while the full scope and restoration of the original site remained unresolved.

Easthampton Public Schools shut down its network Oct. 5, 2026, after staff spotted suspicious activity, limiting phones, email, Wi-Fi and classroom technology. Both schools remained open, using paper-based instruction, manual coordination and borrowed hotspots while forensic specialists investigated.

Indiana Area School District disclosed an Oct. 4, 2026, cybersecurity incident affecting a local server and system access. Superintendent Robert Heinrich said Oct. 5 that desktops were offline and outside specialists were working to restore operations; schools and offices remained open, with students directed to use Chromebooks. Ransomware, local-server data exposure and full recovery remain unresolved.

A BankMobile account compromise disrupted financial aid refund delivery at several California community colleges in October 2026. Los Rios, Foothill–De Anza, Butte College, Long Beach City College, Rancho Santiago and Shasta College documented pauses, delays or paper-check workarounds. Vendor breach scope and full recovery remain unresolved.

Green Clinic in Ruston, Louisiana, lost access to electronic patient records and appointment information during a disruption that began Oct. 2, 2026, according to the Lincoln Parish Journal, leaving some clinicians unable to see patients while others used paper records. The Journal later reported that unnamed clinic sources attributed the disruption to a cyberattack, but Green Clinic had not confirmed the cause, whether data was stolen or when normal operations would resume.

Jefferson County, Missouri, could not process transactions after phone and server problems and canceled two public meetings. Officials said a network security threat led them to take systems offline; the network was still disrupted Oct. 7 while they worked toward restoration. The sheriff's law-enforcement functions were unaffected, and no data breach had been indicated.

A ransomware attack temporarily made some University of Illinois Chicago College of Medicine systems unavailable, and UIC said information was stolen from college servers. UIC said affected systems had been restored by Oct. 5, 2026, with no impact on its main network or UI Health patient care; a Booba Project data-volume claim remains unverified.

A ransomware incident shut down Vicksburg's computer systems and disrupted utility payments, records retrieval and administrative work. Utility account access and payment processing remained disrupted Oct. 6, and customers were not being admitted to the Water and Gas Administration office during a reporter's visit. Water and gas service continued; late fees, penalties and disconnections were suspended. Data impact and full recovery remain unknown.

Terrebonne Parish Consolidated Government took its network and online services offline after detecting a cyberattack Sept. 30, 2026, disrupting online utility payments. Essential operations continued, but the parish's Oct. 3 statement, reproduced Oct. 5, described some systems and services still affected during restoration. Data compromise, ransomware and the full recovery date remain unresolved.

An internet outage associated with a possible data incident disabled Radford's office email, most phones and several municipal services in late September 2026. Most services had returned by Oct. 5, but DMV Select, online GIS tax cards and September utility billing remained affected. Malicious causation, data exposure and full restoration remain unconfirmed.

Kiteworks lifted its precautionary shutdown recommendation Sept. 27 and said vendor-hosted systems were operating normally. It later disclosed a critical flaw found and fixed during the shutdown, with no indication of exploitation or compromise; customer-managed restoration remained deployment-specific.

Unauthorized network access disrupted Stevens Point services Sept. 23. The city said it blocked a suspected ransomware attempt before execution. Recovery was still affecting police records reporting Oct. 7, when no weekly public police report was available. Full restoration, final data findings and attacker identity remain unconfirmed.

A compromise of FBIjobs.gov disrupted recruiting access and exposed personnel information, including information about task-force officers. The FBI said a contractor failed to implement an issued security patch on a third-party platform and was removed; Reuters attributed Accenture and PeopleSoft involvement to unnamed sources. Full breach scope, exact exploit and restoration remain unresolved.

Elsevier's Sept. 21 web redirects disrupted coursework and manuscript access. The redirects cleared, but Moffitt Cancer Center still displayed a precautionary block of Elsevier research and clinical-reference resources when checked Oct. 8; no Moffitt breach or patient-care disruption was established.

Spokane Public Schools restored PowerSchool and payroll access after a September 2026 network security incident, but its Oct. 5 application dashboard still reported some district applications offline, login trouble and stale data in several tools. The forensic investigation and possible data impact remained unresolved.

Ellis County, Kansas, said a ransomware incident affected portions of its information technology systems, leaving some county services unavailable, delayed or operating under temporary procedures. The county said 911 and emergency public-safety response remained unaffected, while the investigation and recovery continued and data exposure remained unresolved.

Direct Communications said a distributed denial-of-service attack disrupted internet service in Eagle Mountain, Utah, beginning Sept. 17, closing City Hall and the library and affecting provider phone and billing systems. The provider said service was restored Sept. 21 and continued investigating and hardening its network. Data impact and actor attribution remained unresolved.

The Well Outreach disclosed Sept. 17 that two Microsoft email accounts were accessed without authorization. It disabled the accounts, forced logouts and warned partners and donors to scrutinize messages. Sept. 19 reporting described recovery; data exposure, ransomware and attribution remain unresolved.

The City of Princeton disclosed a cybersecurity incident in September 2026 affecting municipal systems and later confirmed theft of confidential and personal information. The city said essential services continued normally, while the public record does not establish whether other services or internal workflows were disrupted.

Weld Re-8 School District detected unusual IT activity Sept. 13, 2026, and isolated systems after losing access to network drives, printing and external internet. The district investigated with law enforcement; the specific cyber mechanism, data impact and full recovery remain unconfirmed.

Fenway Health's IT disruption delayed patient communications and coincided with a clinic cancellation. A Sept. 13 spokesperson statement described continuing restoration; patient reports add prescription-fill problems, while cause and full recovery remain unconfirmed.

A cyberattack on Helpfeel's Gyazo image-sharing service exposed user records and image metadata and prompted service suspensions. The platform resumed Sept. 27, 2026, but older shared images remained restricted to owners until they restored delivery.

A possible network security issue disrupted Monroe schools' computers and phones Sept. 10, 2026. WiscNet restored connectivity Sept. 14, but the superintendent described partial recovery and delayed ACT preparation at the Sept. 21 board meeting. Full restoration, cause and data impact remain unconfirmed.

An unauthorized message replaced traffic information on a Caltrans-operated digital sign along Interstate 405 near Westwood on Sept. 8, 2026. Caltrans said it learned of the message Sept. 15, directed its contractor to restore normal operations and began reviewing the message and access history; the access method, actor and restoration time remain unconfirmed.

Hilltop National Bank's cyber incident disrupted digital banking, closed Wyoming offices and complicated customer payroll. After phased restoration, the bank said all systems were operational Sept. 24, ending the documented service disruption.

North Slope Borough School District detected a cyber incident that disrupted districtwide phone service Sept. 8, 2026, and led to temporary school contact numbers. In-person instruction continued, and the district reported normal operations by Oct. 5. Personal information possibly was accessed; ransomware and INC Ransom responsibility remain unconfirmed.

A Sept. 7 cyberattack stopped Mississippi's student financial aid office from processing applications and payments and disrupted enrollment verification uploads; MAAPP continued accepting applications and individual universities were not reported affected. The office announced normal operations and full functionality Sept. 23 while processing outstanding work. Data impact, ransomware and attribution remain unresolved.

Everett closed City Hall Sept. 8-17 after a cybersecurity incident affected municipal systems, shifting basic services to the Connolly Center while public safety and several other services continued. City Hall reopened Sept. 21 with regular municipal services; Everett said the incident was contained and a very small amount of city data was affected, while review of possible personal-information involvement continued.

Greenville County Schools' Gmail suspension was reported by Sept. 5, with a Sept. 9 district statement describing phishing messages and a precautionary response. Google Classroom and files remained available; no dated restoration confirmation was found.

A Sept. 3, 2026, cyberattack disrupted Slate Valley Unified Union School District's internet, email and educational technology. The superintendent confirmed compromised staff records and business documents, a threat to release data and the district's decision against payment. Systems returned in stages; encryption, the full data scope and Kairos attribution remain unverified.

Ransomware disrupted Alabama Board of Nursing licensing and regulatory services Sept. 1, 2026, forcing paper applications and verification workarounds. The board said Oct. 2 that attackers downloaded some data and that sensitive personal or health information may have been exposed. Online compliance monitoring reports also remained unavailable when checked Oct. 8, with October deadlines extended to Oct. 31. Full recovery and the affected-data scope remain unresolved.

A cyber incident closed Springfield schools before they reopened Sept. 14, 2026, with continuing technology restrictions. By Oct. 1, officials described phased restoration of more than 20,000 laptops, with over 1,000 reimaged on the first day; the district also confirmed stolen student and staff information was released. Complete recovery, Interlock attribution and actual file encryption remain unconfirmed.

Westfield Public Schools experienced a network disruption while schools stayed open. Substantial recovery was reported Sept. 15, 2026, but elementary Chromebook onboarding continued and parent-portal access remained pending. Ransomware, data theft and INC Ransom attribution remain unconfirmed.

A cybersecurity incident disrupted Luminis Health patient systems and care. MyChart scheduling, refill requests and messaging returned Sept. 29, but downtime records were still being entered and other systems remained under restoration. Luminis said its patient-record storage system was unaffected; investigation, broader data impact and attribution remain unresolved.

McKesson's August service disruption is resolved. September disclosures narrowed customer-data exposure; an external breach index reported 6.4 million unique email addresses in an alleged leaked corpus, not a confirmed patient count.

The Bureau of Alcohol, Tobacco, Firearms and Explosives shut down a breached standalone system containing information about targets of ATF investigations, creating a limited loss of an internal investigative resource while the agency retained its broader mission capability. Qilin later began publishing files that CNN and an independent researcher said appeared to contain ATF investigative material. ATF has not authenticated the files or attributed the incident, and no public evidence establishes ransomware encryption.

The City of Circleville, Ohio, confirmed ransomware activity affecting portions of its municipal technology environment. The city said operations were restored, affected systems were rebuilt or recovered, no ransom was paid and it was not aware of evidence establishing that sensitive information was exfiltrated. The exact incident and detection dates remain unresolved.

Refrigeration failures were reported at least 14 Defense Commissary Agency stores across 10 states beginning August 26, 2026, restricting chilled and frozen food sales, halting Click2Go at one store, forcing inventory transfers and causing product loss. Three military criminal investigation agencies later confirmed investigations, and Fort Irwin used emergency food orders after repairs were completed August 31. DysruptionHub assesses it is likely (55–80%), with medium confidence, that malicious or unauthorized cyber activity contributed; no public evidence confirms a malicious cause or common mechanism.

Boston Scientific restored disrupted operations Sept. 9. Later disclosures identified limited on-premises access, scoped negative data findings and likely material 2026 financial impact; NHS Supply Chain closed its cyber disruption notice Sept. 25.

An Aug. 25, 2026, ransomware attack disrupted Merrimack County systems, police data access and electronic deed filings. The county said it used backups to restore systems without paying a ransom. The final restoration date and possible personal-data impact remain unresolved, and a Booba Project data-theft claim is unverified.

Northern Counties Health Care disclosed an August 2026 cybersecurity incident that limited some technology functions while its Vermont clinics remained open. The provider warned patients of possible minor delays; the affected systems, actual patient delays, data impact and full recovery date remain unconfirmed.

UC Berkeley restricted access and took EECS systems offline after security tools detected suspicious activity. The department restored services in stages, including its mailing-list server Sept. 17, but the public record did not provide a complete all-clear. The university had not attributed an actor or determined whether data was exposed.

Franklin Mint Federal Credit Union lost website, mobile-app, email, text and digital-banking access beginning August 24 after fmfcu.org transferred registrars and routed to a domain-sale page. FMFCU restored its website and digital banking by August 26, and its current FAQ no longer identifies a remaining unavailable service; core systems, funds and transactions remained available throughout. The incident is presumed resolved operationally, while the cybersecurity investigation, transfer authorization and possible data impact remain unresolved.

Alation confirmed unauthorized activity in one of its systems after an Aug. 18, 2026, service incident degraded Alation Cloud availability for a limited number of customers in its Americas U.S.-East region. Alation restored affected services within an hour, but the public record does not establish whether the unauthorized activity caused the disruption or whether any data was accessed or removed.

Algonac officials said the city water filtration plant experienced a cyberattack targeting cellular modems used to communicate with remote PLCs, but the incident was contained without significant operational impacts. The timing, device class and UIS SCADA remediation closely match the late-July 2026 water-utility campaign, though no public authority has named Algonac as a confirmed campaign victim.

The City of Fort Scott shut down City Hall and its core network after detecting ransomware Aug. 18. Several non-critical machines at municipal sites were affected, while public safety and SCADA remained isolated; officials said full operations were restored by Aug. 23.

Lansing Urgent Care shut down its system after detecting an outsider's attempt to access its network, but did not identify the shutdown's date, duration or effect on patient care. INC Ransom had listed the provider about 24 hours before the first public account, yet the displayed administrative documents do not prove ransomware, data theft or INC's responsibility. No continuing clinic or patient-facing disruption was found by August 30, so the incident is presumed resolved operationally while forensic and attribution questions remain open.

Fort Smith confirmed data theft, publication and a ransom demand. Public-facing services returned, but employees still lacked shared-file access Sept. 24; Interlock attribution remains unconfirmed.

Classes resumed Aug. 24, major services returned and the current technology-alert page showed ordinary planned maintenance rather than continuing incident recovery. The incident is presumed resolved, although the university has not issued an incident-wide all-clear.

Cedar County Memorial Hospital experienced a cyber incident that led it to shut down its IT networks, use hospitalwide downtime procedures and partially divert emergency patients who needed advanced imaging. Routine operations returned Aug. 28, while ransomware, Wallstreet responsibility and possible patient-data exposure remain unconfirmed.

A cyberattack disrupted Andover's shared municipal and school systems beginning Aug. 13, 2026. Records show staged recovery through Aug. 21, when shared files returned but remote VPN access remained unavailable. Town counsel said Sept. 28 that investigators had not yet determined whether protected personal data was obtained or who might require notice; Wallstreet's data-theft claim remains unverified.

Encrypted files disrupted Lincoln municipal systems and closed the town office in August 2026. A later forensic investigation found that some town data was potentially acquired, although sensitive-data involvement, notification requirements and misuse remain unresolved.

Namecheap services and customer websites worldwide went offline August 13 during a cooling-system failure at its Phoenix data center. An early Namecheap status notice reportedly attributed separate Private Email and Jellyfish disruption to a DDoS attack, but the broad outage and staged restoration were tied to unsafe temperatures; full service was reported restored August 14.

Plymouth County Correctional Facility shut down its computer system after detecting unauthorized server access on August 13, suspending in-person visits because staff could not retrieve visitor-clearance records. Attorney visits and incarcerated people's tablet and phone access continued, while state police, the FBI and the Department of Homeland Security investigated. The public record does not establish ransomware, extortion, a threat actor or whether information was acquired.

Darlington County said on August 12, 2026, that a cybersecurity incident affected computer systems and limited services. Regular phone lines at two magistrate offices and the Historical Commission were unavailable, while emergency services and 911 dispatch remained operational. The county's live alert still listed those lines and the Clerk of Court juror-information lines as unavailable September 2.

Attackers exploited a WordPress vulnerability in a public-facing UNMC environment, accessed the web server and placed malicious web shells. UNMC's Brand Wise website was unavailable by Aug. 12, 2026, and the university announced its return Oct. 5 after forensic work, rebuilding and added security controls. UNMC said it found no evidence of sensitive data loss.

Suspicious computer-system activity prompted the Douglas County Sheriff's Office in Kansas to disconnect systems in August 2026, disrupting inmate reports, fingerprint scheduling and shared records access at Lawrence Police. Public inmate-report and fingerprint-scheduling interfaces were available by Sept. 26, but full shared-system recovery was not confirmed. A former Eudora IT administrator alleged ransomware and a connection to Eudora's same-day incident; officials have not confirmed either.

Brazosport College identified a cybersecurity incident affecting its network on August 10, 2026, and took academic, communications and student-record systems offline for phased restoration. D2L returned August 17, and most campus internet and Wi-Fi services were restored by August 20, but guest Wi-Fi remained unavailable. On August 26, the college required students whose passwords predated the incident to reset them, while Qilin's claim of internal data remained unverified.

Brown City officials said a cyberattack changed the IP address of Well No. 3 and stopped the municipal well from producing water until staff restored it within a couple of hours. No actor, ransomware or data theft is established, but the cellular connection, configuration change and UIS SCADA context closely match the late-July 2026 water-utility campaign.

LexisNexis took Nexis Diligence, Nexis Metabase API and Nexis Newsdesk offline after unusual activity was identified on vendor-managed servers. Diligence returned during the August 8-9 weekend with its content catalog still rebuilding, and the other two services were expected to return August 10 after testing. No later continuing service impairment tied to this incident was found by August 30, so the incident is presumed resolved even though the exact restoration time and data impact remain unknown.

Wake County stopped using ElectSure's election-worker training and registration platform after learning August 7 that a hacker had obtained a vendor password with read-only access to records for about 9,000 precinct workers. The county revoked that access and moved to a replacement process, ending the affected platform's operational role; voting machines, ballots, voter-registration records and vote-counting systems were not connected or affected. No continuing registration or training disruption was found by August 30, so the incident is presumed resolved even though the investigation may continue.

The Hamilton Township Municipal Utilities Authority said it identified a likely attempted cyberattack on August 5, isolated and removed the threat, and reported the event to the FBI. The New Jersey utility called the attempt unsuccessful and said drinking-water quality was not affected; DysruptionHub assesses that this may describe the absence of an intended or public-facing consequence rather than prove that no system was reached. The attack timing, affected systems, extent of access, operational effects beyond water quality and any data impact remain unresolved.

Malware compromised Suisun City's IT systems Aug. 7, disrupting 911 routing, dispatch, records, payments and municipal services and forcing City Hall closures. All City Hall departments reopened to the public by Sept. 22, but full network restoration was still underway and city dispatchers continued using the Solano County dispatch center. Data impact, encryption, payment and actor attribution remained unresolved.

The City of Lancaster, Ohio, took municipal computers offline after ransomware notifications on Aug. 6, 2026, warning of delays in card payments and other computer-based work. By Aug. 28, the city had restored about 90% of affected data and programs, but recovery remained incomplete and some material might not return for security reasons.

Coryell County reported a technology disruption affecting several systems August 6 while emergency and essential services continued. No continuing limitation surfaced over the next 25 days, and ordinary county service pages remained available, supporting presumed resolution.

Mitchell, South Dakota, shut down a limited network segment Aug. 6, 2026, after unauthorized activity. Services were restored by Aug. 12. On Sept. 28, the city said a small number of employees' data were impacted and those affected were notified; it reported no indication of malicious data use. Storm's claim remains unverified.

Washburn County shut down technology Aug. 6, 2026, after detecting malicious cyber activity, disrupting communications and internet-dependent services. Departments were functional Sept. 2, residual restoration continued Sept. 8, and booking information returned by Sept. 22; officials reported $59,898.86 in costs as of Sept. 15. Full restoration, ransomware, data impact and attribution remain unresolved.

Woodhaven Lakes last documented server, internet and facility workarounds August 12. Ordinary facility, member and payment information was available by August 31 with no later outage report, supporting presumed resolution while Play's claim remains unverified.

Ransomware disabled Coweta, Oklahoma, computers, files and administrative services beginning August 5, 2026, disrupting City Hall transactions, building permits and in-person card payments while 911 and off-site systems remained available. By August 18, day-to-day operations and utility-payment channels were normal; limited internal restoration and plain-text utility bills remained but were not expected to affect public services. No later public-service impact was found by August 30, so the incident is presumed resolved while technical recovery and the data review may continue.

Waukegan Township said its email system was compromised, disrupting regular access and prompting a warning about malicious messages. Restoration was underway August 5, and no later evidence supports a specific continuing impairment or wider shutdown. The bounded incident is presumed resolved, although the exact recovery date, access vector, data impact and technical scope remain unknown.

Beaver County employees lost access to behavioral-health patient files during a ransomware incident later disclosed Aug. 4. Current service information and the absence of a later access problem support presumed operational resolution, while data and payment consequences remain open.

A cyberattack disrupted systems and delayed gate operations at North Carolina Ports facilities in Wilmington, Morehead City and Charlotte beginning August 4, 2026. Normal gate schedules returned August 6, and by August 18 the authority's ordinary customer tools and operating pages were available without a continuing delay warning, supporting presumed resolution. NC Ports has not published a technical all-clear or confirmed ransomware, data compromise or attribution.

JPS Health Network took systems offline after identifying suspicious activity August 3, disrupting technology, communications, records processing and care workflows across its hospital and clinics. Its core electronic health record returned August 14, ending an ambulance diversion and restoring clinics, laboratories, pharmacies and elective procedures; MyChart followed and routine operations resumed August 16. JPS has not disclosed malicious or unauthorized activity, ransomware, data impact or a responsible actor.

Sawyer Savings Bank closed all four Ulster County branches after an August 3, 2026, network disruption that it later called a likely data security incident involving a vendor vulnerability, while digital banking remained available. The bank reopened all branches August 10 after affected systems were restored and tested, though its investigation into possible data impact continued. A separate Storm claim provides additional cyber evidence but does not establish ransomware, actor responsibility or data theft.

The City of Norcross identified a ransomware incident on Aug. 1, 2026, that affected certain municipal computer systems and caused limited service disruptions. Most systems and services were operational by Aug. 28, but restoration remained underway; the affected services, data impact, ransom activity and responsible actor were not disclosed.

Rapid City said it quickly detected and contained an attempted cyber intrusion involving a municipal wastewater lift station. Officials reported that water and wastewater infrastructure remained safe, drinking water was secure, and no operational disruption occurred while the city investigated with CISA and other federal partners.

A cyber incident closed Southeastern Oklahoma State University's Durant campus July 30, July 31 and August 3, 2026. Ordinary operations later resumed. On September 10, the university said its investigation found unauthorized system access and possible copying of files, and it mailed individual notifications. Interlock's claimed data volume, responsibility and ransomware remain unconfirmed.

A July 27 cyberattack affecting UIS SCADA infrastructure cut remote monitoring for Alpena Township's water and sewer operator and required programmable logic controllers at multiple sites to be reprogrammed. Remote monitoring was restored and utility service remained safe, while the township considered replacing 15 older cellular modems; the access method, data impact and actor remain unknown.

A malicious cyberattack disabled computerized operating controls at Braham's municipal water plant on July 27, 2026, stopping the well and treatment plant for about two hours before crews restored operations without affecting drinking-water quality. Braham was among more than 30 Minnesota water-system attacks, but public attribution remained unresolved despite reports that anonymously briefed officials suspected Iranian hackers.

A July 27, 2026, cyberattack blocked remote access to the City of Cape May Water and Sewer Department's monitoring system, requiring manual controls until normal operations resumed July 28. The city manager said attackers did not change operational settings or take control, and officials said water service, drinking-water safety and customer data were unaffected.

The utility kept water, sewer and gas service operating manually after the July 27 SCADA attack and expected security work to take about two weeks. That period passed without a later continuing limitation, so the incident is presumed resolved.

Intruders gained remote access to Coweta County Water and Sewerage Authority controls on July 27, 2026, changed passwords and disrupted automated control communication, prompting operators to switch to manual operation. Authority officials said water service, water quality and customer data were unaffected. No later operational impact was documented, and the incident is presumed resolved; the final automated-control restoration time and responsible actor remain unknown.

Clayton County Water Authority said unauthorized cyber activity may have caused or contributed to a July 27, 2026, disruption affecting operational systems and water service in north Clayton County. Water pressure was restored within hours, the precautionary boil-water advisory was lifted July 28 after negative water-quality tests, and CCWA said it found no evidence that customer billing or payment information was accessed or compromised.

Columbus Water Works detected and contained a cyberattack on July 27, 2026, affecting portions of its automated monitoring systems. Operators shifted to manual control, and officials reported no interruption to water service or drinking-water quality; the access method and responsible actor remain unknown.

A cybersecurity incident affected automated controls supporting Maple Plain's municipal water utility on July 27, 2026, but contingency procedures kept drinking water safe and water and wastewater services fully operational. Maple Plain was among more than 30 Minnesota water-system attacks; public attribution remained open despite reports that anonymously briefed officials suspected Iranian hackers.

Newton County Schools took affected systems offline after detecting unauthorized network activity, disrupting phones, email and other network services around the start of classes. The district said network services were restored August 6, although technicians were still validating remaining systems and applications. Qilin listed "Newton County School System" and the district's domain on its leak site August 28, but the claim remains unverified and does not establish encryption, data theft or actor responsibility.

Saber Healthcare Group reported that unauthorized corporate network access and file encryption caused an outage of some internal and external systems on July 27, 2026. A spokesperson later said internal systems returned within hours; inaccessible files were restored from backups within 24–48 hours. Its separately hosted electronic medical record system was unaffected, and no patient-care interruption was reported. Potential personal-information exposure remains under review; data theft and the threat actor are unconfirmed.

South St. Paul identified malicious activity affecting automated water-utility controls on July 27, 2026, but contingency procedures kept drinking water safe and water and wastewater services operating normally. The incident was among more than 30 Minnesota water-system attacks; public attribution remained open despite reports that anonymously briefed officials suspected Iranian hackers.

A July 27, 2026, cyber intrusion disrupted phone communications with Woodbine, New Jersey's municipal water system and required employees to reactivate and operate the system manually. Officials said water service continued, drinking water remained safe, no customer data was compromised and the system returned online without further issues.

A July 26 ransomware incident disrupted AnMed's network and patient care in South Carolina and Georgia. AnMed confirmed file locking and unauthorized copying, then announced full operations and restored MyChart functions Sept. 14. Patient-file review continues; HHS lists 501 affected individuals in the Aug. 27 report, not a final total. Interlock attribution remains medium confidence with a conflicting Gentlemen claim.

A cyberattack disrupted cellular communications at two Plymouth water towers and several wastewater lift stations overnight July 26–27, 2026, but crews maintained operations manually without affecting water levels, quality, or public services. Plymouth restored all impacted communications connections July 28 and returned the system to normal operations; attribution remained unresolved.

A cyberattack disrupted work email, internet access, Google Drive and ClassLink applications at Oceanside Unified School District beginning July 24, 2026. By August 18, the district had opened schools and was publishing routine first-day and school-program updates, supporting presumed resolution of the material disruption. Officials have not published a technical all-clear or confirmed affected data, ransomware, extortion or attribution.

City of Dallas security systems detected a possible threat originating outside the municipal network on July 20, 2026, and automatically took three public websites offline. The sites returned after more than 15 hours, while officials reported no network intrusion or loss of city data and said essential emergency, payment and permitting services remained available.

Sumner County Schools discovered unauthorized network access July 20, 2026, disrupting registration and delaying the first day of school from August 4 to August 10. By August 18, the district's website reflected ordinary post-opening school activity, supporting presumed resolution of the material disruption. Officials have not published a technical all-clear or confirmed affected data, ransomware, extortion or attribution.

Malicious traffic disrupted Tidewater Telecom and Lincolnville Communications internet service across coastal Maine beginning July 19, 2026, leaving some connections unusable and significantly limiting Damariscotta Town Office services. The providers reported near-normal service July 21, and their status page subsequently showed customer internet operational with no recurrence through July 26.

AngMar Management Services said an unauthorized actor accessed parts of its network in July 2026, and Teiss reported that some IT systems were disrupted. The federal health department lists 126,196 people affected, while an Indiana filing lists 110,256; the difference is unexplained. Neither the disruption's duration nor any effect on patient care has been established.

Coca-Cola confirmed that ransomware caused unauthorized access, data theft and a temporary suspension of fairlife production in the United States. Most production resumed July 27 while restoration continued, and no later operational impact was documented by August 26. Anubis claimed it released engineering, production and HR material, but Coca-Cola has not verified the actor, alleged files, claimed encryption scope or one-terabyte volume.

Unauthorized network access July 16–27, 2026, accompanied a prolonged Kenaitze Indian Tribe computer and communications outage affecting health and public services. The Tribe began notifications Sept. 25 about possible exposure of personal and health information. Regular phone numbers resumed by Sept. 15, but full restoration and The Gentlemen's responsibility remain unconfirmed.

The Town of Milford, New Hampshire, confirmed unauthorized activity affecting municipal computer systems after phone, internet, clerk, billing, payment and meeting disruptions began July 15, 2026. On July 22, several systems remained offline for analysis, backup processes were still in use, and officials said the cause and full extent had not been confirmed. No later public evidence documented continuing operational impact or provided an authoritative all-clear, so the incident is presumed resolved.

Oklahoma Manufacturing Alliance said ransomware activity targeted two employee computers and affected a limited portion of its local network on July 15, 2026. Staff isolated the systems and restored access through a separate secure network later that morning, while OMA said it found no evidence of data removal or compromised client records.

TruStage's July 11, 2026, cyberattack affected its primary and backup technology infrastructure, forcing a cloud rebuild and prolonged insurance-service delays. Its Oct. 7 partner update said claims, policy servicing and disbursements were still only partially available, with backlogs and manual work continuing as capabilities returned in phases. Data access, ransomware and attribution remain unresolved.

Virginia Peninsula Regional Jail discovered computer-system disruptions around July 14, 2026, determined it was a ransomware incident and later said operations had returned to normal without affecting facility safety or security. The jail said personal information may have been accessed or acquired, while INC Ransom separately claimed to have exfiltrated internal files; no misuse had been identified when the jail issued its notice.

A July 13 cyber incident disrupted Cedar Crest College applications, network drives, OneDrive and file sharing, with July 20 providing the last dated evidence of incomplete restoration. Required orientation and fall classes subsequently began without a located report of continuing material technology disruption, supporting presumed resolution while the exact recovery date remains unknown. The college has not confirmed data access or ransomware, and NightSpire's claim remains uncorroborated.

A large-scale distributed denial-of-service attack disrupted Greenfield Communications internet, television and phone service in Rancho Murieta and other California communities beginning July 12, 2026. Most customers were restored July 14, but IP-geolocation problems continued affecting streaming applications and some remote work through July 17.

Progress Software traced its July 2026 ShareFile Storage Zone Controller shutdown to a high-severity path traversal zero-day affecting all 5.x and 6.x versions and initially released versions 5.12.5 and 6.0.2. The containment action disrupted access to customer-managed files until July 14, but Progress said it had no indication of unauthorized access to customer accounts or data and had identified no active threat.

Greene County, Georgia, took its government network offline after identifying a cybersecurity incident July 9, 2026, disrupting payments and public-request processing while 911 and sheriff operations continued. By August 3, the county had removed its incident notice and the tax-payment application had returned to its normal verification gateway, with no later impact report found; operations are presumed resolved, while final forensic findings remain unpublished.

The St. Lucie County Clerk and Comptroller's externally hosted public website was compromised July 7, 2026, causing an hours-long homepage outage and redirecting some links to an unauthorized third-party site. Staff removed a malicious script and restored the site from a known-good backup; the clerk confirmed the compromise July 8, reported no evidence of access to internal systems or their data, and warned of possible slower performance during database re-indexing.

Pennington County's July 4, 2026, ransomware incident forced office closures and restricted administrative services. Online property-tax payments returned Oct. 2, and Oct. 5 reporting said nearly all services were back online after a network rebuild. Full restoration, data impact and actor identity remain unresolved.

Jacksonville, Texas, detected suspicious network activity July 3, 2026, took affected municipal systems offline and used workarounds while some online services were unavailable. By August 3, the city website and payment services were operating, its alert center reported no active alerts and no later impact was found, so operations are presumed resolved. No final forensic, breach, ransomware or attribution update has been published.

Vista Del Mar Child and Family Services took its network offline after detecting suspicious activity on June 30, 2026, and later determined that an unauthorized actor accessed certain systems. The Los Angeles nonprofit said it remained operational and continued scheduled services while reviewing files that may have contained personal and protected health information. HHS lists the event as a hacking or IT incident affecting 500 people, and the public record does not identify the actor, access vector or ransomware.

Salida School District's June 29 cyberattack damaged local files and disrupted Central Office work. At the Sept. 15 board meeting, the superintendent reported attack-related delays to building-automation implementation. No complete restoration notice, ransomware confirmation or actor attribution has been found.

DCHA discovered a cybersecurity incident June 28, 2026, shut down its network and restored services in phases. It confirmed compromised sensitive information July 17 and announced normal operations for every department beginning July 20; no later disruption was found by August 3, so operations are presumed resolved. Interlock's ransomware and 1,660 GB theft claim remains unverified.

Delaware County, Pennsylvania, detected anomalous network activity June 26, 2026, and took its network offline after remote attackers accessed the network and county-maintained data, disrupting phones, servers, financial software, libraries and other public services. The county did not publicly acknowledge cyber involvement until July 2; an earlier Sheriff's Office explanation that called the outage a provider disruption was inconsistent with the county's later account of detecting and containing the intrusion June 26. The county restored operations using secure backups, while potential exposure of sensitive data remains under review.

American Color Imaging experienced a systems outage from June 24 to July 1, 2026, that paused production, held submitted orders, delayed customer communications and disabled an ordering platform. Settra publicly claimed on July 16 that it stole 653 GB of data, but ACI has not confirmed a cyberattack, unauthorized access, data theft or the actor's involvement.

Akron Public Schools detected and contained a June 23, 2026, cyber incident that caused a districtwide network outage and closed every district building June 24. Most programs, offices and athletics resumed June 25, but online credit recovery remained canceled through June 26 while external specialists investigated the incident's nature and scope.

The Wise County Sheriff's Office said hackers hit its systems twice during the week before June 22, 2026, preventing records retrieval and printing of incoming public-information requests. Logged and saved requests were lost or inaccessible and had to be rebuilt from sent email files. The deadline suspension ended July 5 and official request channels are currently available, but full restoration and recovery of missing requests remain unconfirmed.

University City, Missouri, confirmed that malicious cyber activity caused a network outage first publicized June 17, 2026, disrupting permitting, public-record access, card processing and online bill payment. On August 6, the city said affected systems and services had been restored and that its investigation found no evidence personal information was accessed, removed or compromised.

River Financial Corporation confirmed unauthorized access, ransomware deployment and removal of data from its network, including River Bank & Trust. A July 30 SEC amendment said River attempted to suppress the affected data and obtained the threat actor's representation that the stolen data was deleted. River did not say deletion was verified or disclose a ransom payment, and the affected information and potential materiality remain unresolved.

NAIC detected unauthorized access to its PeopleSoft environment on June 11, 2026, after exploitation of a zero-day vulnerability. Data was acquired and published, while suspended credit-rating feeds disrupted insurer investment designations and online invoice payments remained unavailable in the latest official update.

Prince George County, Virginia, said a June 11, 2026 cyber incident disrupted phones, internet and online payments before systems were secured and normal operations resumed. The county said personal data may have been accessed and offered identity monitoring, while RansomHouse's ransomware and attribution claims remain unverified.

Spartanburg County isolated portions of its network after detecting questionable activity on its computer infrastructure June 10, 2026, disrupting phones, courts, payments and records for nearly three weeks. Officials never publicly labeled the event a cybersecurity incident or confirmed malicious access, but the county's system-activity and security-response wording provides concrete cyber evidence under registry criteria. Core connectivity returned June 29, and operations are presumed resolved.

Onslow County Schools detected unauthorized criminal activity June 9, 2026, disrupting phones, internet, digital services, testing and graduation livestreams across the district. The district later said a relatively small portion of data was exfiltrated; by June 23 the attack was contained and major services were returning, but staged infrastructure restoration and the data-impact review remained underway.

The City of Acworth, Georgia, documented network outages and possible service interruptions June 8, 2026, then confirmed June 18 that a cybersecurity incident had affected certain computer systems and that all systems were restored. INC Ransom later claimed the city, alleged possession of municipal data and threatened release, but Acworth has not confirmed the actor, data theft, ransomware, a demand or payment.

Ransomware disrupted Evanston Township High School District 202 systems, phones, internet and safety functions beginning June 7, forcing a two-day campus closure and cancellations. The district documented limited systems and phased recovery through July 17, and the school opened for the 2026-27 year on August 17 without a newer report of a specific continuing operational disruption. Material impacts are presumed resolved, while payment, personal-information access and actor attribution remain unresolved.

Lewis Brisbois Bisgaard & Smith LLP restricted outside access to internal networks after a June 2026 cyberattack and directed remote and hybrid employees to work from offices or use firm-issued computers. The public record does not establish whether attackers successfully entered the network, accessed client or employee data, deployed ransomware, made an extortion demand or caused a client-service outage.

YouLend US LLC detected a disruption to its computer network on June 9, 2026, and determined that an unauthorized party accessed the network from June 5 through June 9 and acquired files containing personal information. A later Texas attorney general record listed 2,826 affected Texans and exposure involving names, Social Security numbers and financial information. The company secured affected systems and notified authorities; no threat actor or extortion demand has been confirmed.

Kittson County reported a cyber incident involving its emergency-services network, prompting Minnesota IT Services to block the county’s access to state motor-vehicle systems as a precaution. Full DMV services were temporarily unavailable while limited tab payments and Department of Natural Resources transactions continued; emergency services remained operational, and ransomware, data theft and NightSpire attribution were unconfirmed.

Bowman Parks & Recreation disclosed at a June 2, 2026, city commission meeting that a cyberattack encrypted every department file and connected thumb-drive backups, making the records inaccessible. The files were later decrypted with outside expert assistance, but the attack date, initial access method, ransom or payment status, data-copying scope and public-facing service impact remain unresolved.

Nacogdoches County identified a phishing-related cybersecurity incident on May 28, 2026. Online pay-stub access was unavailable and paper stubs were in use July 1 while payroll and other county services continued; no newer operational-impact evidence was found by August 3, so the disruption is presumed resolved. A Texas AG listing reported 1,100 affected Texans.

Chelan County, Washington shut down government networks, computers and telephone systems after detecting malware on May 24, 2026. Email, phones, records access and other county functions remained disrupted for weeks, and the Clerk's Office later reported a backlog exceeding 6,000 documents as systems were restored.

Alexandria, Tennessee temporarily shut down Town Hall and police computers after fraudulent purchases were discovered in the town's Amazon account. The town later said only that account was affected and no public information was compromised or delayed; in June, aldermen approved five replacement computers and a managed-security service.

A cyberattack affected certain Commonwealth of the Northern Mariana Islands government email accounts on the cnmi.gov and dof.gov.mp domains, leaving some users without access. The Office of Information Technology initiated systemwide security protocols and corrective actions, but officials did not disclose the attack method, number of affected accounts, data impact, or final restoration date.

Delano Public Schools canceled classes May 20 after ransomware compromised its network; students returned the next day with limited connectivity. On June 10, the district said effects continued, old file folders were compromised through a firewall, and student and staff data was not compromised, narrowing an earlier statement that district data was likely stolen. LockBit claimed the attack and demanded $1.2 million, which the district said it did not pay.

The Scottsboro Police Department in Alabama said it detected and stopped an attempted cyberattack targeting department servers. Officials reported no evidence that police reports, photographs, videos, identifying information or other sensitive data were accessed, exported or compromised, and no service disruption was documented.

Chanhassen Dinner Theatres in Minnesota took systems offline after detecting a cyberattack on part of its network on May 15, 2026. Phone, computer and food-and-beverage systems were disrupted, and the attack came with a ransom note; performances were canceled or rescheduled before reopening May 21 on a temporary system. Current official ticketing information again lists normal payment and gift-card redemption options, supporting resolved status, while encryption, data theft, payment and attribution remain unconfirmed.

Krum Public Library confirmed that a May 14, 2026, ransomware attack disrupted computer access, printing and Wi-Fi and temporarily limited checkout to five items. The library later secured its network, and current official pages again advertise normal services; unauthorized file access was confirmed, while NightSpire's claim to have stolen 50 GB remains unverified.

Murray County, Georgia closed or limited several government offices after a ransomware attack disrupted county computer systems on May 13, 2026. County officials later said most systems had been restored and that the county paid $200,000 to prevent attackers from publishing county data, while 911, public safety, and voting remained available.

Boyne City, Michigan, experienced a cybersecurity incident May 11, 2026, that disrupted municipal computer access, email, utility billing, online payments and account-history functions. By July 31, online payments had returned and delayed billing had resumed, although staff were still restoring billing history and catching up on billing cycles; no later continuing service impact was found by August 30. The Gentlemen later claimed the city, but Boyne City has not confirmed the actor, ransomware or data theft.

Mountain Park, Oklahoma, identified unauthorized access to municipal systems on May 11, 2026, and requested assistance from the Oklahoma State Bureau of Investigation. The town said administrative email was disrupted, while emergency services and utility operations were not interrupted; the access method, responsible party and possible copying of municipal data remain unresolved.

Malicious code on Stack Sports' Sports Affinity checkout pages captured payment information entered from about May 8 until residual elements were cleared June 22, 2026. Stack Sports notified affected users after finalizing its transaction review July 17; the exposed fields may have included cardholder names, card numbers, expiration dates, CVVs and some checking-account numbers.

Allegany County Transit said a cybersecurity incident involving a third-party scheduling vendor required riders with May 6–7, 2026, pickups to call and confirm their trips. Public evidence points to IT Curves as the likely vendor, while Ababil of Minab separately claimed it compromised IT Curves and wiped and stole data; neither the vendor link nor the actor’s technical claims were confirmed.

West Pharmaceutical Services detected a cyberattack on May 4, 2026, in which an unauthorized party exfiltrated data and encrypted systems. The company took systems offline globally, disrupting manufacturing, shipping, receiving, and enterprise operations before reporting full operational restoration on May 20.

Exploitation of CVE-2026-41940 compromised Government of Guam web infrastructure and disrupted access to agency websites, downloads and public documents beginning in May 2026. The Bureau of Statistics and Plans later removed its restoration warning and repopulated report and data pages; the incident is presumed resolved because no territorial government all-clear establishes the exact recovery date.

A coordinated cyberattack forced the San Diego Community College District to shut down network systems, disrupting internet, Wi-Fi, websites, file servers, transcript processing, instruction and student services across San Diego City, Mesa, Miramar and Continuing Education colleges. Miramar directly confirmed the attack, while districtwide restoration proceeded by college and concluded with normal service status on May 15. The district said protected data was not compromised, and the public record does not establish ransomware or a threat actor.

DysruptionHub first reported Foxconn's multi-day Wisconsin network and production outage on May 5, 2026, before any other news publication identified in the reviewed chronology. Foxconn confirmed seven days later that a cyberattack affected some North American factories and said production was resuming, although workers at Mount Pleasant still described a slow, partial recovery. Nitrogen's claim of stealing approximately 8 TB of data remains unverified, and Foxconn has not identified every affected factory.

Kentwood Public Schools said a student used malicious software designed to disrupt its system, causing Wi-Fi connectivity problems throughout the Michigan district. Police investigated, outside experts helped isolate the issue, and the district said the technology problems appeared to have been resolved.

Instructure confirmed two related Canvas intrusions that exposed user, enrollment, course and message data and prompted a platform-wide outage May 7, 2026. Canvas returned to normal service, and the final incident-related Free-for-Teacher retrieval window ended July 29; continuing data review and notifications are breach-response activities rather than an ongoing service disruption.

Advanced Diagnostic Imaging, P.C., doing business as AdvancedHEALTH, said it detected suspicious activity on April 28, 2026 and determined that an unauthorized actor gained access to information on its systems. Columbia Surgical Partners had separately described ransomware at its parent and loss of EHR access. AdvancedHEALTH's June notice said its data review was ongoing and found no evidence of misuse; DragonForce's claimed 390 GB theft remains unverified.

Kent District Library disclosed a ransomware event after a computer outage beginning April 24, 2026 closed all 22 branches and disrupted public access to computers, printing and other services. Most services were restored by July 9, but KDL still reported limited printing and unavailable gaming labs while recovery work continued.

Harrison County, West Virginia, discovered ransomware-related computer disruptions around April 23, 2026, affecting courthouse services, tax payments and administrative functions while public-safety and election systems remained intact. Operations later returned to normal, but the county warned that personal information may have been accessed; SafePay claimed responsibility and data theft, but the county did not confirm the claim or resulting exposure.

Cherry Health experienced organizationwide technology issues in April 2026 that disrupted its phone system while clinics remained open. The provider later confirmed unauthorized access and copying of network data, and HHS listed the breach as a network-server hacking incident affecting 501 people.

A ransomware attack that Adams County officials said began April 17, 2026, disrupted county networks, digital court and public records, vehicle registration, and noncash payments while the sheriff's separate systems remained available. Most county IT was restored by early May, but vehicle-tag services were still unavailable on May 19; no ransom demand, data-theft finding, responsible actor or final restoration date was publicly established.

Tallahassee officials confirmed an April 17, 2026 cyberattack affecting parts of the city's technology environment, and the public website became unavailable that afternoon. City staff said they isolated the threat and initially found no operational impact, while Leon County disconnected a shared network link as a precaution and warned of possible outages in linked applications.

Maryland took the Department of Assessments and Taxation's statewide Real Property Search application offline after detecting suspicious server activity April 14, 2026, directing users to local assessment offices during the outage. The state restored and cleared the tool for public use April 27 after testing found no evidence of a broader compromise.

The City of Palouse, Washington restored its public website from a hosting-provider backup after officials said the site had been hacked. Some recently added content was missing and required re-entry, while the city reported that no sensitive data was involved.

Clinton County, Iowa, took portions of its network and internet connectivity offline after monitoring detected unusual activity consistent with the early stages of an attempted internet intrusion. The county said the threat was contained, all critical systems and services were restored by April 16, 2026, and later forensic findings showed no county data was accessed or extracted and no systems or records were damaged.

Spring Lake Park Schools discovered on April 12, 2026 that an outside actor had accessed district systems and shut systems down to contain further access. Classes were canceled for two days, along with child care and community programs, while the district restored phones, building security, fire-protection and other safety-dependent technology.

Signature Healthcare detected suspicious network activity on April 6, 2026, and shifted affected Massachusetts operations to downtime procedures. Brockton Hospital diverted ambulances, chemotherapy appointments were canceled, pharmacies could not fill prescriptions and electronic records services were impaired before staged restoration concluded later in April.

The Standard-Examiner in Ogden and Daily Herald in Provo, both owned by Ogden Newspapers, reported significant production difficulties that disrupted Monday and Tuesday newspaper printing and delivery in early April 2026 while their digital editions remained available. Qilin later listed only the Standard-Examiner on May 2, but neither newspaper has confirmed ransomware, data theft or a connection between the claim and the shared printing disruption.

Winona County detected a second, distinct 2026 ransomware attack on April 7 after malicious activity began April 6, prompting a local emergency declaration, system isolation and Minnesota National Guard cyber assistance. DMV and vital-statistics services remained offline on April 10, the county reported secure restoration of its network and critical public systems by April 24, and it later confirmed that attackers released information acquired from the network.

A cyber incident at Minidoka Memorial Hospital in Rupert, Idaho, temporarily affected internal systems, limited imaging services and prompted transfers of some emergency patients, while the hospital and clinics continued treating patients. Full imaging access was restored by midnight April 19, 2026; a Blackwater leak-site claim alleging data theft remains unverified and was not confirmed by the hospital.

Karl Auto Group discovered on April 4, 2026, that an unauthorized third party had accessed business systems, disrupting phones and computers across its Iowa dealership operations. The company said files may have contained sensitive customer and employee information, while RansomHouse separately claimed Karl Chevrolet and alleged encryption; ransomware, exfiltration and a connection to that actor remain unconfirmed.

Chevin Fleet Solutions took affected U.S. and U.K. FleetWave environments offline after disclosing a cybersecurity incident on April 2, 2026, causing a major service outage for fleet-management customers. Missouri's state fleet system became unavailable and required phone workarounds, while Chevin later confirmed unauthorized access to customer databases containing operational and personal information.

Uplink documented a cybersecurity event that disrupted BAT-MINI alarm signaling and interactive services used by dealers and monitored accounts across the United States from April 2 to April 4, 2026. The M2M Services-owned brand restored all BAT-MINI services by April 4 but did not disclose the event’s cause, affected-account count, data impact or a responsible actor.

Belgrade School District in Montana confirmed that malware affected systems in its network after technology problems began in early April 2026. The incident disrupted routine school functions, including lunch processing and assignments, while restoration continued and the district reviewed whether student or staff information outside Infinite Campus was affected.

Gritman Medical Center described an electronic-systems outage that closed multiple outpatient clinics beginning April 1, 2026, while its hospital and emergency department remained open. Clinics reopened April 6, although four rural sites still had phone outages; the provider called the event a cybersecurity incident but reported no successful system access or known patient-data compromise in its preliminary findings.

The City of Anthony reported missing public records, inaccessible systems and wiped police devices after a change in administration, limiting normal municipal records work. DysruptionHub assesses with medium confidence that the incident involved insider activity and digital information destruction, although the public record does not establish who acted or whether the actions were authorized.

A ransomware attack discovered March 31, 2026, directly affected the Patriot Regional Emergency Communications Center and the Town of Pepperell, disrupting Pepperell's network for about one week and non-emergency public-safety phone service across PRECC's five member towns. PRECC is a joint regional service administered day to day by Pepperell and governed by representatives of Ashby, Dunstable, Groton, Pepperell and Townsend; it is not a separate municipality. 911 and emergency response continued, and available evidence does not show that the other four towns' municipal networks were compromised.

Hasbro identified unauthorized access to its network on March 28, 2026, took certain systems offline and used business-continuity measures while restoring operations. The incident disrupted order processing, shipping and invoicing throughout the second quarter, with Hasbro estimating an approximately $25 million revenue impact before returning to pre-incident practices.

The City of Martinsville, Virginia, detected a cyberattack March 25, 2026, that disrupted computer systems and delayed or limited services in the municipal building. City Manager Robert Fincher said April 9 that city services were fully operational. A later city notice said personal information might have been accessed but reported no evidence of misuse.

Ransomware disabled the Jackson County Sheriff's Office network in Indiana in March 2026, leaving computers, Wi-Fi and the police-report system inaccessible. Dispatchers shifted to Seymour Police Department computers, officers wrote reports in Word documents and technicians rebuilt the environment while officials said the county would not pay a ransom.

North Attleborough Public Schools detected unauthorized network activity on March 25, 2026, and later shut down districtwide internet access as a precaution. The outage disrupted communications and limited classroom technology access, but instruction continued and officials said all network connectivity was restored by April 1.

Ransomware disrupted internet, Wi-Fi, Gmail and Google applications across Alamo Heights ISD from March 23 to March 27. The district later said personal information was accessed and potentially downloaded, affecting 26,629 people, and said no ransom was paid. WorldLeaks and Qilin posted separate victim listings, but the conflicting claims do not establish who caused the incident.

Puerto Rico security monitors detected and neutralized a cyberattack attempt against DTOP on March 23, prompting officials to disconnect systems and pause CESCO appointments across the territory. CESCO centers resumed regular operations March 26 except Utuado, which still required additional validation. Officials said resident information remained secure, and no stable public actor claim was identified.

The Town of Colebrook said a municipal email account was hacked, prompting New Hampshire to suspend state-system connections serving the Town Clerk's Office and dispatch. The disconnection interrupted vital-records, election and DMV access; vital records and election functions were restored by March 27, 2026, while DMV and dispatch reconnection remained pending.

An unauthorized actor accessed an Infinite Campus employee's Salesforce account March 18, 2026, prompting the company to disable some customer-facing services while investigating an extortion demand. ShinyHunters claimed the intrusion, and data associated with about 137,100 school-staff accounts was publicly released and indexed; Infinite Campus did not name the actor. The service disruption is presumed resolved, while data publication is confirmed.

Mile Bluff Medical Center disclosed an April 2026 security event involving data encryption that disrupted phone and computer functions and forced clinical teams to use downtime procedures while patient care continued. A later breach notice said an unauthorized actor had accessed the network from March 18 through April 19 and copied files, while the electronic health record was not affected.

A breach of Navigate360's P3 Global Intel platform exposed millions of crime, school safety and federal tips. Crime Stoppers of Oregon paused P3 submissions, Portland police directed tipsters elsewhere, and the Oregon program later closed, citing the breach among several factors. Sandy Hook Promise tip data appeared in the stolen records; it said its reporting system remained operational.

San Felipe-Del Rio CISD detected suspicious email activity March 18 before internet, phones and other in-network communications and data systems went down. Schools, classes and transportation continued. WorldLeaks later listed the district, but the claim does not prove ransomware, data theft or actor responsibility; the incident is presumed resolved.

Clayton detected suspicious network activity on one system March 18 and manually took its network offline, limiting phones and online services during restoration. By March 23, investigators said attempted data access was unsuccessful and found no evidence that customer or employee data was compromised. No stable public actor claim was identified, and no later continuing impact was found.

Pro-Iran imagery and a Farsi control message replaced the Yeshiva World News homepage March 18, interrupting access to the outlet's website and articles before it displayed a maintenance page. The website later resumed normal publishing. No stable actor claim or evidence of ransomware or extortion has surfaced, leaving attribution unresolved.

LA Metro restricted internal administrative systems after detecting unauthorized activity March 16, disrupting arrival information and some TAP fare-loading channels while buses and trains continued operating. Ababil of Minab claimed the intrusion; later technical research found LA Metro data on infrastructure tied to the operation, supporting high-confidence attribution and data theft but not the actor's claimed destruction or exfiltration volumes. The incident is presumed resolved because no continuing operational impact has been documented since April 2.

A security incident prompted Lucas County to take systems offline in mid-March, disrupting the AREIS property-records portal and dog-licensing service. Public-facing systems were accessible again and AREIS was restored March 17, supporting resolved operational status, while the cause, data impact and actor remain undisclosed.

At Sage Water Resources' Duchesne, Utah, saltwater-disposal facility, an attacker altered PLC safety logic on March 15, 2026, bypassing shutdown protections and leaving pumps running dry while the control system showed normal operation. A truck driver spotted the mismatch; workers shut down automation, continued receiving wastewater under manual control, and avoided pump failure, service interruption and environmental harm. Sage said a contractor rebuilt and verified the safety logic and restored continuous operation within days.

A cyberattack disrupted network resources used by Goodwill Industries of Greater Grand Rapids at 18 stores across six western Michigan counties in March 2026, forcing cash-only sales while the nonprofit rebuilt its point-of-sale program. An Interlock listing contained material appearing to identify the regional affiliate despite an incorrect Pennsylvania label, but Goodwill did not confirm ransomware, data theft or attribution.

A March 14 cyberattack led Intoxalock to pause systems supporting installations, calibrations, account access and service centers across its nationwide network. Some drivers could not start their vehicles, and two named shops reported blocked work; Intoxalock said core services resumed March 22. State agencies addressed compliance consequences, but no agency outage was documented, and ransomware, attribution and data theft remain unconfirmed.

Minot officials said ransomware affected a Water Treatment Plant SCADA server March 14, 2026, prompting isolation and about 16 hours of manual monitoring before a backup restored local visibility. A connected Northwest Area Water Supply system returned to full operation March 17, but its data link with Minot remained disabled May 20 while water safety, pressure and customer service remained intact.

Ransomware disrupted the DeKalb County Sheriff's Department and jail server March 13, interrupting email and inmate booking. Booking data was recovered that evening, but the public record does not provide a full restoration date, identify the ransomware family or establish data theft.

Duffy’s Sports Grill experienced multi-day card-payment and MVP loyalty disruptions at multiple Florida restaurants beginning by March 13. Customer reports also described cash-only service, a manual card workaround, event cancellations and at least one temporary closure. Qilin’s March 14 listing remains a low-confidence attribution claim, and no later continuing impact was identified, so the incident is presumed resolved.

A March 2026 network intrusion disrupted Aroostook Mental Health Center connectivity and business operations across its service area in Aroostook, Hancock and Washington counties. Qilin claimed the organization on March 24, and AMHC later confirmed that an unauthorized actor accessed its network on March 11-12 and copied files containing personal information. The federal breach portal lists 501 affected people, while the Maine filing leaves the total undetermined.

Hanover County Public Schools lost divisionwide internet access and multiple systems after a malicious actor accessed network data and attempted to deploy ransomware in March 2026. Instruction continued without normal technology until internet and core platforms began returning March 18. HCPS said personal information may have been viewed or accessed, but it reported no indication of misuse and did not identify the actor.

A March 11 destructive cyberattack wiped about 40,000 Stryker laptops and disrupted its Microsoft environment, global manufacturing, order processing, shipping and some customer procedures. Handala claimed the attack; federal authorities later said an Iran intelligence ministry-controlled Handala domain was used to claim the operation, supporting high-confidence attribution, while the actor's 200,000-device and 50 TB theft assertions remain unverified. Stryker said its manufacturing, commercial, ordering and distribution systems were restored by April 1. Later reporting described residual peripheral vascular supply constraints into September.

Unauthorized access to a CareCloud EHR environment March 10–16 disrupted functionality and data access for about eight hours March 16 before restoration. Forensics confirmed exfiltration; HHS now reports 3,756,469 affected individuals, including a revised Texas filing identifying 270,529 Texans. Ransomware involvement and the responsible actor remain unresolved.

A cybersecurity incident affected portions of Rusk County’s network and led the county to engage forensic specialists while restoring safe, remediated systems. Qilin later claimed the March incident at low confidence because the county did not corroborate attribution; a Lynx listing concerned a separate November 2025 outage. The dated effects are older than 30 days with no continuing outage identified, supporting presumed-resolved status.

Belhaven University took portions of its internal network offline March 6 after identifying a cybersecurity incident. Some services remained unavailable March 18; most student services were operating normally and online classes were scheduled to resume March 19. No final all-clear was published, supporting presumed-resolved rather than resolved status.

Passaic County said a March 4 ransomware event made its network, phones, computers and internet inoperable, and the county later said most operations had been restored. Medusa claimed responsibility and threatened to publish data, but the county did not confirm the attribution or the scope of any data access.

Alcorn School District disabled its network March 1 after suspicious activity disrupted certain systems and threatened scheduled testing. LockBit later claimed the Mississippi district and demanded an undisclosed ransom, but the district did not confirm ransomware, actor responsibility, encryption or data theft. No later operational-impact notice or formal restoration statement was found, and the incident is presumed resolved.

Vivian’s Door, a Mobile, Alabama, nonprofit, took its systems offline for three days in March 2026 after suspicious activity and emails impersonating the organization. Executive Director Janice Malone told The Verge the shutdown interrupted business and left an approximately $3,000 response bill; possible exposure of stored financial data remains unconfirmed.

Ransomware detected March 19 disrupted Foster City's municipal services, with staged recovery continuing in April. A later city notice confirmed unauthorized access from Feb. 28 to March 25 and possible viewing or acquisition of personal-information files; no actor or final restoration date is established.

A cyber-related IT disruption that LCCC said began February 27 closed all four sites March 4 and moved classes online. Campuses reopened in stages by March 23, but Wi-Fi and telephone effects continued into April. Medusa claimed LCCC on March 17, and a secondary tracker reported a $100,000 demand and alleged exfiltration, but the claim does not establish ransomware deployment, data theft or Medusa responsibility.

Attackers encrypted Peak Software Systems infrastructure, backups and internal systems supporting the Sportsman platform, disrupting municipal recreation registration, reservations, rentals and payments in at least six cities. Lehi City later said an unauthorized party accessed systems and that certain Legacy Center files may have been accessed or acquired. Services were restored, the incident was contained and no stable threat-actor claim was found.

Wagon Mound Public Schools said a virus shut down district internet and networked computers around February 26, 2026, while its insurer worked to restore systems and staff and student devices were collected for scanning. Interlock listed the district March 9 and claimed it obtained about 80 GB of staff and student information, but the district has not confirmed ransomware, the actor or data theft. March 3 remains the last dated evidence of disruption, supporting presumed-resolved status without establishing an exact recovery date.

Ohio County Schools disabled district internet after detecting evidence of a potential cybersecurity attack Feb. 24, disrupting connected learning and administrative work for nearly a week. The district reported full functionality March 2 and said it had no evidence that student or employee data was at risk; the mechanism and actor remain unresolved.

NewspaperArchive said an unauthorized third party remotely accessed and encrypted systems hosting its historical-newspaper platform in February 2026, making the service unavailable to libraries and subscribers. Core search and download functions returned during a phased recovery, but some publications and personal accounts remained unavailable as of May 19.

A ransomware attack struck the University of Mississippi Medical Center on Feb. 19, 2026, disabling Epic records, phone and email systems and closing 35 clinics across 23 Mississippi municipalities. Clinics and phone service returned March 2 after nine days, while Medusa later claimed the attack and demanded $800,000 to prevent publication of allegedly stolen data.

A technology outage closed Town Hall, Public Works and Community Development offices in Orange, Virginia, for parts of three days in February 2026 and temporarily limited Town Hall payments to cash or checks. LockBit listed `townoforangeva.gov` on its leak site March 5, providing concrete external cyber evidence but not proving that ransomware caused the outage, that data was stolen or that the town confirmed the claim.

Huntington, West Virginia, detected suspicious activity on February 17, 2026, and isolated municipal systems during a cybersecurity investigation. A limited number of internal systems were affected and normal operations returned February 19; Termite later claimed the city, but the listing remains uncorroborated.

Livingston HealthCare disclosed a potential cybersecurity incident on February 13, 2026, after phone and network services were disrupted and some systems were taken offline. Phones returned February 16, but staff still could not use the patient portal February 18; the final recovery date and possible patient-data compromise remain unresolved.

Ransomware locked computer systems at the Virgin Islands Economic Development Authority by Feb. 12, 2026, and prompted a demand exceeding $300,000. Officials investigated whether beneficiary tax records were exposed; no actor, payment or confirmed data theft has been disclosed, and later board activity showed some operations had resumed without establishing an exact restoration date.

A cyberattack disrupted the State College Borough network Feb. 11, 2026, delaying email responses and closing the Centre Region Council of Governments building, which depended on borough IT services. Borough offices, phones and public-safety services remained available; the exact restoration date was not disclosed.

Meriden's municipal network shutdown disrupted payments, records, meetings and library services. Later city breach notices identified ransomware and possible exposure affecting 2,325 Connecticut residents; INC Ransom attribution remains unconfirmed.

Cocoa experienced an IT disruption after an external-system breach spanning February 8-16, 2026, disrupting phones, payments and municipal workflows while emergency and water operations continued. The city initially described the event only as "technical issues," then notified 896 people of hacking June 4, 107 days after its first public operational disclosure and 101 days after INCRansom claimed the city. The claim remains unconfirmed, and some system restoration was still underway March 10.

A ransomware attack disrupted BridgePay payment services beginning Feb. 6, 2026, affecting merchants and municipal billing. BridgePay said gateway instances were restored by Feb. 28, though partner connections took longer; Lightspeed reported one connection still unavailable March 4 and restored March 10.

A Pinellas County arrest affidavit alleges that a former Clearwater Public Library System technology employee used a library administrative account on February 5, 2026, to remove Deep Freeze security software from about 200 public computers. The action led the city to shut down patron computers at three Florida library branches, while the accused employee pleaded not guilty and no theft, fraud or misuse of personal information was alleged.

Tulare City School District investigated suspicious cyber activity that disrupted computer systems and phone service in early February 2026. Phones were restored by Feb. 10 and broader system recovery was nearing completion; ransomware, data theft and SingularityMD attribution remain unconfirmed.

Denmark School District lost internet across its facilities for five school days beginning January 30, requiring paper-based instruction and administrative workarounds. The district later acknowledged a potential data security incident; teachers said at least 60 current and former employees were affected and alleged that the district received a ransom note, while INC Ransom separately claimed encryption and theft of about 71 GB. The district did not corroborate the actor's claims or link reported employee tax fraud to the incident, and the documented internet disruption ended February 5.

A security incident affecting CloudCone's Budget VPS platform in Los Angeles executed an unauthorized management-layer script, displayed ransom messages and made affected virtual-server disks irrecoverable. CloudCone restored the affected platform Feb. 11, 2026; other regions and service platforms were not affected.

Ransomware disrupted New Britain municipal systems Jan. 28, forcing manual workarounds while emergency services continued. Later breach-notice reporting identified possible personal-data exposure affecting 10,339 Connecticut residents.

The Town of Edisto Beach disclosed a potential cybersecurity incident involving email on Jan. 22, 2026. The town later said the event was an isolated cyber fraud scheme that caused an undisclosed financial loss, nearly 89% of which was recovered, with no resident or customer information compromised.

Winona County's January 2026 ransomware attack disrupted phones, internal systems, records access and county services. Recorder's-office recovery work continued March 12. The county later confirmed data theft affecting 6,196 people and a $128,539.57 ransom payment; officials said insurance covered about $50,000 and the county levy about $78,000.

Ransomware encrypted Community College of Beaver County systems March 9, closing the main campus and disrupting classes, account access and academic and financial records. CCBC later said an unauthorized party accessed its systems from January 16 through March 9 and obtained information that may have included names, Social Security and passport numbers, and financial account information with credentials. The college returned to full operational status March 30; Interlock's separate claim of responsibility and 780 GB of stolen data remains uncorroborated.

Midway, Florida, officials confirmed ransomware involving the police department’s SmartCOP records system in January 2026. The incident disrupted access to records and delayed public-records requests while investigators assessed possible data impact.

Anchorage Police Department shut down certain servers and disabled vendor access after learning Jan. 7, 2026, that a software provider involved in an upgrade had been attacked. APD found no evidence its systems were compromised or its data acquired.

Beacon Mutual detected unauthorized access Jan. 14, 2026, disconnected systems and restored production Jan. 20. The company later confirmed that files containing Social Security numbers and other sensitive information were copied; INC Ransom separately claimed responsibility and 275 GB of data.

Oakland Community Unit School District 5 detected unauthorized access during the 2025-26 winter break, contained the attack and restored systems from backups before students returned. Attackers demanded payment, but the district did not pay and reported no operational disruption or known sensitive-data impact.

Ransomware disrupted Metro Pet Vet and Manheim Pike Veterinary Hospital in Lancaster County, Pennsylvania, in January 2026, blocking access to a shared server and patient records at three clinics. Staff used paper records and a scheduling app while continuing urgent and scheduled care; data access or theft and the threat actor remain unresolved.

An attempted cyber intrusion identified about Dec. 8, 2025, led the Cheyenne and Arapaho Tribes to take systems offline, disrupting government communications and education administration. Rhysida later claimed the incident and demanded 10 bitcoin; ransomware deployment and data theft remain unverified.

Milton, Florida, detected suspicious activity consistent with ransomware on December 26, 2025, and secured its network. Utility billing, automatic payments and online payment services were disrupted into spring 2026, while investigators reported no evidence that city information was taken.

A ransomware attack at Evergreen Printing Company in Bellmawr, New Jersey, disrupted newspaper printing and subscriber fulfillment in December 2025. A customer publication reported problems with press operations, mailing lists and company communications as Evergreen investigated and restored systems.

Singing River Health System temporarily shut down select systems after identifying a potential cyber incident in December 2025. MyChart access and phones were disrupted before the portal was restored later that day. A later health-system notice confirmed unauthorized network access Dec. 19-21 and access to files containing patient information.

Snyderville Basin Water Reclamation District said monitoring detected an intruder encrypting files on an ArcGIS server in December 2025. The district isolated the server and recovered the files; it tentatively associated the event with China and Flax Typhoon, but the attribution and ransomware theory remain unconfirmed.

Fessenden-Bowdon School reported a cybersecurity incident affecting its Google domain Dec. 15, 2025. Staff email was unreliable, some information appeared deleted and families were warned that phishing messages might come from school accounts. Administrators directed families to call the school while working with Google to secure the domain.

Minersville Area School District detected malware installation attempts Dec. 15, 2025, shut down its network and canceled classes Dec. 16-19 while specialists investigated. District officials described ransomware; a Dec. 19 notice said some files were copied without permission and systems had been securely restored.

A local radio station reported a Pell City Schools cyber incident Dec. 14, 2025, as paper-based instruction and phone trouble were reported. The district later documented an internet outage and told families some files were copied but its student information system was unaffected. SafePay listed the district, but its responsibility and the scope of copied data remain unverified.

Deschutes Public Library closed all branches Dec. 12-14, 2025, and took its website and in-building services offline after unauthorized access to older communications servers. A March 2026 library notice said some personal information was involved, revising the initial belief that patron and staff records were unaffected.

West Pierce Fire & Rescue reported a cybersecurity incident that interrupted email, nonemergency phone lines and other information systems by Dec. 12, 2025. The agency said it detected unauthorized access and worked with the FBI and forensic experts. Fire suppression, EMS and 911 services remained operational.

Eanes Independent School District lost Wi-Fi Dec. 6-12, 2025, disrupting access to Skyward and Google Classroom and forcing paper-based schoolwork. A student newspaper quoted administrators describing a cybersecurity situation. Qilin later listed the district as a purported victim, but the district did not confirm ransomware or a link to the listing.

PES Energize, the municipal electric and broadband utility in Pulaski, Tennessee, reported a cybersecurity incident Dec. 5, 2025, that disabled office phones and computers. The utility closed its customer lobby, suspended in-person and phone payments, and directed outage reports to alternate channels; power and broadband delivery were not reported disrupted.

The United Keetoowah Band of Cherokee Indians in Oklahoma reported an IT issue Dec. 4, 2025, that delayed services across tribal offices, including tag services and suboffices. Its Stilwell office later closed for a day. Rhysida listed the tribe as a purported victim Dec. 12, but the tribe did not confirm a cyberattack, ransomware or a connection to the disruption.

A December 2025 cybersecurity incident compromised part of the Gadsden County Sheriff’s Office IT infrastructure and caused the loss or deletion of financial reports. The event, combined with accounting staffing shortages and weak backup and recovery processes, kept the office’s books from being ready for audit until June 2026 and contributed to the county’s late annual audit.

Pit River Health Service reported a cybersecurity incident that interrupted electronic health record and Dentrix dental-system access in December 2025. Patients were asked to bring medication and insurance information while staff used slower paper-based processes; the clinic later said some information may have been copied.

Clarksville Independent School District warned Nov. 26, 2025, that all district computers and its network were having major problems and told staff and students to stop using connected devices. A later Interlock victim listing claimed data theft, but the district had not confirmed ransomware, a cyber cause for the outage or a connection between the two in the December report.

A cyberattack on Puerto Rico IT contractor Truenorth Corporation during Thanksgiving week 2025 affected systems at the Department of Education, Health Insurance Administration and State Insurance Fund Corporation. Officials said agency staff and PRITS restored affected databases and systems from backups without reported interruption to public-facing services. Independent reporting described ransomware, which officials did not confirm.

Northwest Iowa Community College experienced a computer network disruption in late November and early December 2025 that canceled on-campus classes and impaired campus technology services. The college later confirmed unauthorized activity and said information may have been accessed or downloaded between November 24 and November 26, 2025. Its July 2026 breach filing identified 16,004 Iowa residents whose names and Social Security numbers were potentially affected.

Southold's November 2025 ransomware attack disrupted town servers and records processing. Most systems returned by December, but its public records portal remained offline until June 2026. Rhysida later claimed the attack; the town has not confirmed that claim or data theft.

The City of Urbana said a Nov. 23, 2025, cyberattack disrupted several municipal computer systems. It said police, fire, public works, courts and emergency response continued to operate while technical teams investigated.

Hillsborough County reported that a Nov. 23, 2025, network outage was caused by a cybersecurity incident and that it took affected systems offline. The county said public safety and emergency services continued to operate normally while it investigated and restored systems.

A reflection distributed denial-of-service attack began Nov. 22, 2025, against Jackson County Public Schools in North Carolina. The district closed all schools Nov. 25 when network repairs took phones, internet and campus safety systems offline; it reported normal network function that evening.

The Georgia Superior Court Clerks' Cooperative Authority detected network access by an intruder Nov. 21, 2025, and restricted websites and applications while stopping an attempted ransomware attack before encryption. Electronic records and filings were disrupted statewide; the authority said systems returned to normal by Nov. 28.

The City of Attleboro, Massachusetts, detected suspicious network activity on Nov. 20, 2025, and took systems offline, disrupting municipal email, most phone lines and routine City Hall work. Emergency response and public schools remained operational; municipal phone and email service was later restored, but the city had not issued a final investigative or data-impact finding as of September 2026.

The Cleveland County Sheriff's Office reported ransomware affecting parts of its internal computer system in November 2025. It said 911 and deputy response continued; Rhysida later claimed responsibility and data theft, which the office has not verified.

A cyberattack disrupted Leavenworth, Kansas, municipal systems beginning Nov. 19, 2025. The city confirmed the cyber cause Nov. 25 and directed vendors, permit applicants and job seekers to use mail or in-person workarounds while it restored services.

Rainbow Communications reported a Nov. 16, 2025, cybersecurity event that interrupted hosted business and home phone services in northeast Kansas. The company said all affected services were restored by Nov. 19; INC Ransom later claimed the attack and data theft, which Rainbow has not verified.

Trumbull County officials investigated a possible breach involving an unnamed vendor in November 2025. The recorder suspended electronic filings and online public-record access, directing residents to limited in-person service.

Living Room Theaters said a Nov. 13, 2025, cyberattack made most of its computers unusable and closed its Portland and Indianapolis cinemas. Box office transactions and refunds were affected; Portland reopened Nov. 21.

The Village of Golf Manor confirmed that ransomware encrypted its computer network and backups after an intruder accessed the network Nov. 13–14, 2025. The village later said files contained information about employee health plans and began notifying potentially affected people in January 2026.

Santa Paula reported a Nov. 12, 2025, citywide network outage affecting email and internal servers and potentially limiting city services. Qilin later listed the city as a claimed victim, but the city has not confirmed ransomware, data theft or the group's responsibility.

A Lakewood Towne Center digital billboard displayed unauthorized political images in November 2025. Police suspected a hack, and property managers disabled the sign for about two days while investigating with vendors.

Zion Elementary School District 6 closed all schools and offices Dec. 1-3, 2025, after discovering a cybersecurity incident and suspending some systems. Classes resumed Dec. 4. A later district notice confirmed unauthorized network access Nov. 11-25 and that files containing personal information were viewed or taken.

Lake Superior State University experienced an IT disruption beginning around Nov. 10, 2025. A campuswide message from its chief information officer described ransomware affecting some computers, while online learning and other technology services remained limited.

OnSolve's legacy CodeRED alerting platform was damaged in a November 2025 cyberattack, disrupting emergency notification capabilities for customer jurisdictions. The provider decommissioned that system, moved customers to a separate replacement and said associated account data had been removed by attackers.

Valley View ISD in Hidalgo County disclosed a November 2025 cyber incident that disrupted computers and phones. A later Texas attorney general filing reported 3,806 Texans affected and listed names, Social Security numbers and dates of birth as exposed information.