DysruptionHub registry intelligence

Registry insights

See where documented incidents concentrate, who they affect and how their characteristics change over time.

277 Incidents Documented in this reporting window

298 Affected organizations Linked across 277 incidents

53 States and territories With documented impact

665 Impacted locations Distinct places linked to incidents

96 Attributed incidents 35% name a threat actor

37 Active or presumed active 13% of incidents in this period

Tempo

Incident activity

277 incidents dated in this period

Attribution and disclosure

35% with a named threat actor in the registry 96 of 277 incidents

83% with a recorded official cyber disclosure 230 of 277 incidents

55% officially disclosed on the first-signal date 126 of 230 incidents with comparable dates

13.2 mean days to later official disclosure Across 104 incidents disclosed after the first-signal date

Threat actors

Explore

Interlock 15 5%
Qilin 15 5%
INC Ransom 12 4%
ShinyHunters 6 2%
NightSpire 4 1%
Rhysida 4 1%

6 threat actors tied at 3 incidents; this tied group is not shown.

Footprint

Geographic impact

Explore the incident map

Counties

Showing 5 of 69 counties with repeated impact. 5 counties tied at 4 incidents; this tied group is not shown. 266 additional counties each appeared in one incident.

Cities

Los Angeles, California 5 2%
Washington, District of Columbia 4 1%

Showing 2 of 44 cities with repeated impact. 8 cities tied at 3 incidents; this tied group is not shown. 488 additional cities each appeared in one incident.

Concentration

State-by-sector matrix

Each incident is counted once per state-sector pair.

Incident counts by state or territory and critical infrastructure sector
State or territory	Government Services and Facilities	Healthcare and Public Health	Information Technology	Water and Wastewater Systems	Emergency Services	Commercial Facilities
Texas	16	4	3	—	1	—
California	9	4	4	—	—	1
Georgia	7	2	2	3	—	—
Michigan	4	3	2	3	—	1
Florida	6	2	2	—	2	1
Massachusetts	7	4	2	—	2	—
Minnesota	5	2	1	4	—	1
Pennsylvania	9	2	—	—	—	—

Affected ecosystem

Organizations and infrastructure

Organizations with repeated impact

Explore

Winona County 2 1%

297 additional organizations each appeared in one incident.

Organization types

General Government Administration 103 37%
Local / municipal / county government administration 94 34%
Public Education 54 19%
K-12 school district / LEA 41 15%
Information Technology & Telecom 27 10%
Public Utilities & Infrastructure Operators 21 8%

3 organization types tied at 16 incidents; this tied group is not shown.

Critical infrastructure sectors

Government Services and Facilities 157 57%
Healthcare and Public Health 31 11%
Information Technology 21 8%
Water and Wastewater Systems 17 6%
Emergency Services 15 5%
Commercial Facilities 10 4%
Financial Services 10 4%
Transportation Systems 7 3%

Incident status

Presumed Resolved 138 50%
Resolved 102 37%
Active 24 9%
Presumed Active 13 5%

Characteristics

Mechanisms and impacts

Explore relationships

Attack mechanisms

3 mechanisms tied at 4 incidents; this tied group is not shown.

Operational impacts

Internal systems unavailable 147 53%
Network outage 89 32%
Partial service outage 80 29%
Government services disrupted 76 27%
Customer or public access restricted 69 25%
Manual workaround required 67 24%
Alternate service channel required 61 22%
Phone service disruption 58 21%

Data impacts

Extortion indicators

Public record

Assessment and transparency

Cyber assessment

Confirmed 267 96%
Suspected 8 3%
Unresolved 2 1%

Ransomware confidence

Unresolved 118 43%
Confirmed 45 16%
Low 40 14%
Not Ransomware 31 11%
Medium 22 8%
High 16 6%
Suspected 1 0%

Cyber transparency

Official cyber 220 79%

The organization publicly identifies the event as cyber-related.
External cyber only 24 9%

Only external sources publicly identify the event as cyber-related.
External cyber → official 23 8%

External sources identified the event as cyber-related before the organization publicly confirmed it.
Cyber determination pending 9 3%

The disruption is documented, but available public information does not yet establish cyber involvement.

Disruption transparency

Official disruption 246 89%

The organization publicly documents the resulting service disruption.
External disruption only 23 8%

Credible external sources document the disruption, but the organization does not clearly do so.
No disruption cues 8 3%

No credible public source clearly documents service disruption.

How these figures are calculated

Figures describe published registry coverage, not the prevalence of cyber incidents overall. Incidents are grouped by their canonical incident date rather than publication date.

An incident is counted once within each category. Geographic totals use explicitly impacted incident locations and do not treat an organization headquarters as an impacted place. Municipal impacts roll up to their recorded county and state, with each incident counted once per place. Affected organization counts use primary, victim, operator and owner relationships. Critical infrastructure and organization taxonomies remain separate.

Threat actor figures include only actors attached through eligible public claims. Same-date disclosure compares the calendar date of the first public signal with the calendar date of the official cyber disclosure; it does not measure elapsed hours or response speed. Mean days to later disclosure is the arithmetic mean only among valid intervals greater than zero, so longer intervals have more influence. Missing, invalid or reverse-ordered date pairs are excluded. Empty or unknown values are not inferred.

Registry data last updated Oct 8, 2026.