152
Incidents
Documented in this reporting window
DysruptionHub registry intelligence
Registry insights
See where documented incidents concentrate, who they affect and how their characteristics change over time.
169
Affected organizations
Linked across 152 incidents
45
States and territories
With documented impact
397
Impacted locations
Distinct places linked to incidents
48
Attributed incidents
32% name a threat actor
28
Active or presumed active
18% of incidents in this period
Tempo
Incident activity
152 incidents dated in this period
Attribution and disclosure
32%
with a named threat actor in the registry
48 of 152 incidents
96%
with a recorded official cyber disclosure
146 of 152 incidents
52%
officially disclosed on the first-signal date
76 of 146 incidents with comparable dates
13.7
mean days to later official disclosure
Across 70 incidents disclosed after the first-signal date
Threat actors
Explore-
Interlock 8 5%
-
Qilin 6 4%
-
INC Ransom 4 3%
-
LockBit 3 2%
-
NightSpire 3 2%
-
ShinyHunters 3 2%
-
The Gentlemen 3 2%
5 threat actors tied at 2 incidents; this tied group is not shown.
Footprint
Explore the incident map
Geographic impact
State impact
Bubble area represents incident count; one incident may appear in multiple states.
Ranked by incident count; one incident may appear in multiple states.
All 45 affected states and territories are shown.
-
Texas 16 11%
-
Minnesota 12 8%
-
Georgia 10 7%
-
Michigan 10 7%
-
California 9 6%
-
Florida 9 6%
-
Massachusetts 8 5%
3 states or territories tied at 7 incidents; this tied group is not shown.
Counties
-
Utah County, Utah 3 2%
Showing 6 of 35 counties with repeated impact. 29 counties tied at 2 incidents; this tied group is not shown. 177 additional counties each appeared in one incident.
Cities
-
Kentwood, Michigan 3 2%
-
Walker, Michigan 3 2%
-
Wyoming, Michigan 3 2%
Showing 3 of 24 cities with repeated impact. 21 cities tied at 2 incidents; this tied group is not shown. 302 additional cities each appeared in one incident.
Concentration
State-by-sector matrix
Each incident is counted once per state-sector pair.
| State or territory | Government Services and Facilities | Healthcare and Public Health | Water and Wastewater Systems | Information Technology | Commercial Facilities | Emergency Services |
|---|---|---|---|---|---|---|
| Texas | 9 | 2 | — | 2 | — | 1 |
| Minnesota | 5 | 1 | 4 | 1 | 1 | — |
| Georgia | 4 | 1 | 3 | 1 | — | — |
| Michigan | 3 | 3 | — | 1 | 1 | — |
| California | 4 | 1 | — | — | 1 | — |
| Florida | 5 | 1 | — | 1 | 1 | — |
| Massachusetts | 3 | 1 | — | 2 | — | 2 |
| Utah | — | 1 | — | 4 | 1 | — |
Affected ecosystem
Organizations and infrastructure
Organizations with repeated impact
Explore-
Winona County 2 1%
168 additional organizations each appeared in one incident.
Organization types
-
Public Education 26 17%
-
K-12 school district / LEA 18 12%
Critical infrastructure sectors
-
Healthcare and Public Health 15 10%
-
Information Technology 12 8%
-
Emergency Services 7 5%
-
Financial Services 4 3%
Incident status
-
Resolved 64 42%
-
Presumed Resolved 60 39%
-
Active 22 14%
-
Presumed Active 6 4%
Characteristics
Explore relationships
Mechanisms and impacts
Attack mechanisms
-
Unknown cyber mechanism 71 47%
-
Unauthorized access 46 30%
-
Ransomware 35 23%
-
Malware 10 7%
-
Data extortion 7 5%
-
Website defacement 3 2%
Operational impacts
-
Internal systems unavailable 84 55%
-
Partial service outage 57 38%
-
Network outage 54 36%
-
Manual workaround required 45 30%
-
Service delay 33 22%
Data impacts
-
Unknown data impact 68 45%
-
Data unavailable 45 30%
-
Data theft or exfiltration 22 14%
-
Unauthorized data access 16 11%
-
No known data impact 15 10%
-
Data encryption 13 9%
2 impacts tied at 3 incidents; this tied group is not shown.
Extortion indicators
-
No known extortion indicator 53 35%
-
Leak-site listing 43 28%
-
Data-theft extortion 21 14%
-
Unknown extortion indicators 20 13%
-
Public leak threat 18 12%
-
Ransom demand 16 11%
2 indicators tied at 8 incidents; this tied group is not shown.
Public record
Assessment and transparency
Cyber assessment
-
Confirmed 151 99%
-
Unresolved 1 1%
Ransomware confidence
-
Unresolved 65 43%
-
Confirmed 27 18%
-
Not Ransomware 24 16%
-
Low 16 11%
-
Medium 13 9%
-
High 7 5%
Cyber transparency
-
Official cyber 133 88%
The organization publicly identifies the event as cyber-related.
-
External sources identified the event as cyber-related before the organization publicly confirmed it.
-
External cyber only 6 4%
Only external sources publicly identify the event as cyber-related.
-
The disruption is documented, but available public information does not yet establish cyber involvement.
Disruption transparency
-
Official disruption 142 93%
The organization publicly documents the resulting service disruption.
-
Credible external sources document the disruption, but the organization does not clearly do so.
-
No disruption cues 3 2%
No credible public source clearly documents service disruption.
How these figures are calculated
Figures describe published registry coverage, not the prevalence of cyber incidents overall. Incidents are grouped by their canonical incident date rather than publication date.
An incident is counted once within each category. Geographic totals use explicitly impacted incident locations and do not treat an organization headquarters as an impacted place. Municipal impacts roll up to their recorded county and state, with each incident counted once per place. Affected organization counts use primary, victim, operator and owner relationships. Critical infrastructure and organization taxonomies remain separate.
Threat actor figures include only actors attached through eligible public claims. Same-date disclosure compares the calendar date of the first public signal with the calendar date of the official cyber disclosure; it does not measure elapsed hours or response speed. Mean days to later disclosure is the arithmetic mean only among valid intervals greater than zero, so longer intervals have more influence. Missing, invalid or reverse-ordered date pairs are excluded. Empty or unknown values are not inferred.