155
Incidents
Documented in this reporting window
DysruptionHub registry intelligence
Registry insights
See where documented incidents concentrate, who they affect and how their characteristics change over time.
172
Affected organizations
Linked across 155 incidents
45
States and territories
With documented impact
402
Impacted locations
Distinct places linked to incidents
49
Attributed incidents
32% name a threat actor
28
Active or presumed active
18% of incidents in this period
Tempo
Incident activity
155 incidents dated in this period
Attribution and disclosure
32%
with a named threat actor in the registry
49 of 155 incidents
96%
with a recorded official cyber disclosure
149 of 155 incidents
52%
officially disclosed on the first-signal date
77 of 149 incidents with comparable dates
15.9
mean days to later official disclosure
Across 72 incidents disclosed after the first-signal date
Threat actors
Explore-
Interlock 8 5%
-
Qilin 6 4%
-
INC Ransom 4 3%
-
LockBit 3 2%
-
NightSpire 3 2%
-
ShinyHunters 3 2%
-
The Gentlemen 3 2%
5 threat actors tied at 2 incidents; this tied group is not shown.
Footprint
Explore the incident map
Geographic impact
State impact
Bubble area represents incident count; one incident may appear in multiple states.
Ranked by incident count; one incident may appear in multiple states.
All 45 affected states and territories are shown.
-
Texas 16 10%
-
Minnesota 12 8%
-
California 10 6%
-
Georgia 10 6%
-
Michigan 10 6%
-
Florida 9 6%
-
Massachusetts 8 5%
4 states or territories tied at 7 incidents; this tied group is not shown.
Counties
-
Polk County, Iowa 3 2%
-
Utah County, Utah 3 2%
Showing 8 of 35 counties with repeated impact. 178 additional counties each appeared in one incident.
Cities
-
Kentwood, Michigan 3 2%
-
Walker, Michigan 3 2%
-
Wyoming, Michigan 3 2%
Showing 3 of 24 cities with repeated impact. 21 cities tied at 2 incidents; this tied group is not shown. 305 additional cities each appeared in one incident.
Concentration
State-by-sector matrix
Each incident is counted once per state-sector pair.
| State or territory | Government Services and Facilities | Healthcare and Public Health | Water and Wastewater Systems | Information Technology | Commercial Facilities | Emergency Services |
|---|---|---|---|---|---|---|
| Texas | 9 | 2 | — | 2 | — | 1 |
| Minnesota | 5 | 1 | 4 | 1 | 1 | — |
| California | 5 | 1 | — | — | 1 | — |
| Georgia | 4 | 1 | 3 | 1 | — | — |
| Michigan | 3 | 3 | — | 1 | 1 | — |
| Florida | 5 | 1 | — | 1 | 1 | — |
| Massachusetts | 3 | 1 | — | 2 | — | 2 |
| Pennsylvania | 6 | 1 | — | — | — | — |
Affected ecosystem
Organizations and infrastructure
Organizations with repeated impact
Explore-
Winona County 2 1%
171 additional organizations each appeared in one incident.
Organization types
-
Public Education 28 18%
-
K-12 school district / LEA 20 13%
Critical infrastructure sectors
-
Healthcare and Public Health 15 10%
-
Information Technology 12 8%
-
Emergency Services 7 5%
-
Financial Services 4 3%
Incident status
-
Resolved 67 43%
-
Presumed Resolved 60 39%
-
Active 22 14%
-
Presumed Active 6 4%
Characteristics
Explore relationships
Mechanisms and impacts
Attack mechanisms
-
Unknown cyber mechanism 71 46%
-
Unauthorized access 49 32%
-
Ransomware 36 23%
-
Malware 10 6%
-
Data extortion 8 5%
2 mechanisms tied at 3 incidents; this tied group is not shown.
Operational impacts
-
Internal systems unavailable 87 56%
-
Partial service outage 58 37%
-
Network outage 55 35%
-
Manual workaround required 46 30%
-
Service delay 33 21%
Data impacts
-
Unknown data impact 68 44%
-
Data unavailable 46 30%
-
Data theft or exfiltration 24 15%
-
Unauthorized data access 18 12%
-
No known data impact 15 10%
-
Data encryption 13 8%
-
Data exposure 5 3%
Extortion indicators
-
No known extortion indicator 54 35%
-
Leak-site listing 44 28%
-
Data-theft extortion 21 14%
-
Unknown extortion indicators 20 13%
-
Public leak threat 18 12%
-
Ransom demand 17 11%
Public record
Assessment and transparency
Cyber assessment
-
Confirmed 154 99%
-
Unresolved 1 1%
Ransomware confidence
-
Unresolved 65 42%
-
Confirmed 28 18%
-
Not Ransomware 25 16%
-
Low 17 11%
-
Medium 13 8%
-
High 7 5%
Cyber transparency
-
Official cyber 135 87%
The organization publicly identifies the event as cyber-related.
-
External sources identified the event as cyber-related before the organization publicly confirmed it.
-
External cyber only 6 4%
Only external sources publicly identify the event as cyber-related.
-
The disruption is documented, but available public information does not yet establish cyber involvement.
Disruption transparency
-
Official disruption 145 94%
The organization publicly documents the resulting service disruption.
-
Credible external sources document the disruption, but the organization does not clearly do so.
-
No disruption cues 3 2%
No credible public source clearly documents service disruption.
How these figures are calculated
Figures describe published registry coverage, not the prevalence of cyber incidents overall. Incidents are grouped by their canonical incident date rather than publication date.
An incident is counted once within each category. Geographic totals use explicitly impacted incident locations and do not treat an organization headquarters as an impacted place. Municipal impacts roll up to their recorded county and state, with each incident counted once per place. Affected organization counts use primary, victim, operator and owner relationships. Critical infrastructure and organization taxonomies remain separate.
Threat actor figures include only actors attached through eligible public claims. Same-date disclosure compares the calendar date of the first public signal with the calendar date of the official cyber disclosure; it does not measure elapsed hours or response speed. Mean days to later disclosure is the arithmetic mean only among valid intervals greater than zero, so longer intervals have more influence. Missing, invalid or reverse-ordered date pairs are excluded. Empty or unknown values are not inferred.