39
Incidents
Documented in this reporting window
DysruptionHub registry intelligence
Registry insights
See where documented incidents concentrate, who they affect and how their characteristics change over time.
40
Affected organizations
Linked across 39 incidents
22
States and territories
With documented impact
77
Impacted locations
Distinct places linked to incidents
5
Attributed incidents
13% name a threat actor
22
Active or presumed active
56% of incidents in this period
Tempo
Incident activity
39 incidents dated in this period
Attribution and disclosure
13%
with a named threat actor in the registry
5 of 39 incidents
97%
with a recorded official cyber disclosure
38 of 39 incidents
66%
officially disclosed on the first-signal date
25 of 38 incidents with comparable dates
3.5
mean days to later official disclosure
Across 13 incidents disclosed after the first-signal date
Threat actors
Explore-
Interlock 2 5%
-
The Gentlemen 2 5%
-
INC Ransom 1 3%
-
Storm 1 3%
Footprint
Explore the incident map
Geographic impact
State impact
Bubble area represents incident count; one incident may appear in multiple states.
Ranked by incident count; one incident may appear in multiple states.
All 22 affected states and territories are shown.
-
Georgia 5 13%
-
Minnesota 4 10%
-
Texas 4 10%
-
New Jersey 3 8%
7 states or territories tied at 2 incidents; this tied group is not shown.
Counties
42 additional counties each appeared in one incident.
Cities
62
affected cities
No city appears in more than one incident in this period.
Concentration
State-by-sector matrix
Each incident is counted once per state-sector pair.
| State or territory | Government Services and Facilities | Water and Wastewater Systems | Healthcare and Public Health | Emergency Services | Information Technology | Transportation Systems |
|---|---|---|---|---|---|---|
| Georgia | 1 | 3 | 1 | — | — | — |
| Minnesota | — | 4 | — | — | — | — |
| Texas | 3 | — | 1 | — | — | — |
| New Jersey | — | 3 | — | — | — | — |
| Illinois | 1 | — | — | — | — | — |
| Massachusetts | 1 | — | — | 1 | — | — |
| New York | — | — | — | — | 1 | — |
| North Carolina | 1 | — | — | — | — | 1 |
Affected ecosystem
Organizations and infrastructure
Organizations with repeated impact
Explore
40
affected organizations
No organization appears in more than one incident in this period.
Organization types
-
Public Education 5 13%
4 organization types tied at 2 incidents; this tied group is not shown.
Critical infrastructure sectors
-
Water and Wastewater Systems 12 31%
-
Emergency Services 2 5%
-
Financial Services 1 3%
Incident status
-
Active 19 49%
-
Resolved 13 33%
-
Presumed Resolved 4 10%
-
Presumed Active 3 8%
Characteristics
Explore relationships
Mechanisms and impacts
Attack mechanisms
-
Unknown cyber mechanism 27 69%
-
Unauthorized access 6 15%
-
Ransomware 4 10%
-
Malware 2 5%
-
Data extortion 1 3%
Operational impacts
-
Internal systems unavailable 24 62%
-
Manual workaround required 17 44%
-
Partial service outage 17 44%
4 impacts tied at 8 incidents; this tied group is not shown.
Data impacts
-
Unknown data impact 26 67%
-
Data unavailable 10 26%
-
Data encryption 4 10%
-
No known data impact 2 5%
Extortion indicators
-
No known extortion indicator 20 51%
-
Leak-site listing 4 10%
6 indicators tied at 2 incidents; this tied group is not shown.
Public record
Assessment and transparency
Cyber assessment
-
Confirmed 38 97%
-
Unresolved 1 3%
Ransomware confidence
-
Unresolved 24 62%
-
Not Ransomware 5 13%
-
Low 4 10%
-
Confirmed 3 8%
-
Medium 2 5%
-
High 1 3%
Cyber transparency
-
Official cyber 34 87%
The organization publicly identifies the event as cyber-related.
-
External sources identified the event as cyber-related before the organization publicly confirmed it.
-
The disruption is documented, but available public information does not yet establish cyber involvement.
Disruption transparency
-
Official disruption 36 92%
The organization publicly documents the resulting service disruption.
-
No disruption cues 2 5%
No credible public source clearly documents service disruption.
-
Credible external sources document the disruption, but the organization does not clearly do so.
How these figures are calculated
Figures describe published registry coverage, not the prevalence of cyber incidents overall. Incidents are grouped by their canonical incident date rather than publication date.
An incident is counted once within each category. Geographic totals use explicitly impacted incident locations and do not treat an organization headquarters as an impacted place. Municipal impacts roll up to their recorded county and state, with each incident counted once per place. Affected organization counts use primary, victim, operator and owner relationships. Critical infrastructure and organization taxonomies remain separate.
Threat actor figures include only actors attached through eligible public claims. Same-date disclosure compares the calendar date of the first public signal with the calendar date of the official cyber disclosure; it does not measure elapsed hours or response speed. Mean days to later disclosure is the arithmetic mean only among valid intervals greater than zero, so longer intervals have more influence. Missing, invalid or reverse-ordered date pairs are excluded. Empty or unknown values are not inferred.