Skip to content
DysruptionHub
Sign in Subscribe
DysruptionHub registry intelligence

Registry insights

See where documented incidents concentrate, who they affect and how their characteristics change over time.

Reporting period Year to date
225 Incidents Documented in this reporting window
Tempo

Incident activity

225 incidents dated in this period

Incident activity over time Jan 2026: 12; Feb 2026: 17; Mar 2026: 32; Apr 2026: 21; May 2026: 17; Jun 2026: 19; Jul 2026: 34; Aug 2026: 42; Sep 2026: 24; Oct 2026: 7 0 21 42 Jan 2026: 12 incidents Jan 2026 Feb 2026: 17 incidents Mar 2026: 32 incidents Mar 2026 Apr 2026: 21 incidents May 2026: 17 incidents May 2026 Jun 2026: 19 incidents Jul 2026: 34 incidents Jul 2026 Aug 2026: 42 incidents Sep 2026: 24 incidents Sep 2026 Oct 2026: 7 incidents Oct 2026

Attribution and disclosure

32% with a named threat actor in the registry 73 of 225 incidents
93% with a recorded official cyber disclosure 210 of 225 incidents
54% officially disclosed on the first-signal date 114 of 210 incidents with comparable dates
9.2 mean days to later official disclosure Across 96 incidents disclosed after the first-signal date

Threat actors

Explore
  1. Interlock 11 5%
  2. INC Ransom 10 4%
  3. Qilin 9 4%
  4. ShinyHunters 5 2%
  5. NightSpire 4 2%

5 threat actors tied at 3 incidents; this tied group is not shown.

Footprint

Geographic impact

Explore the incident map

State impact

Bubble area represents incident count; one incident may appear in multiple states.

Ranked by incident count; one incident may appear in multiple states.

State and territory impact bubbles Bubble area represents incident count. Texas: 22 incidents; California: 20 incidents; Georgia: 15 incidents; Michigan: 14 incidents; Florida: 13 incidents; Massachusetts: 13 incidents; Minnesota: 13 incidents; Pennsylvania: 10 incidents; Utah: 9 incidents; Wisconsin: 9 incidents; Illinois: 8 incidents; Ohio: 8 incidents; Virginia: 8 incidents; Mississippi: 7 incidents; New Jersey: 7 incidents; North Carolina: 7 incidents; Arizona: 6 incidents; Missouri: 6 incidents; Tennessee: 6 incidents; Alabama: 5 incidents; Indiana: 5 incidents; Kansas: 5 incidents; New York: 5 incidents; Oklahoma: 5 incidents; South Carolina: 5 incidents; Washington: 5 incidents; District of Columbia: 4 incidents; Idaho: 4 incidents; Iowa: 4 incidents; New Hampshire: 4 incidents; Puerto Rico: 4 incidents; Arkansas: 3 incidents; Colorado: 3 incidents; Maine: 3 incidents; Maryland: 3 incidents; New Mexico: 3 incidents; Rhode Island: 3 incidents; South Dakota: 3 incidents; West Virginia: 3 incidents; Alaska: 2 incidents; Connecticut: 2 incidents; Louisiana: 2 incidents; Montana: 2 incidents; Nebraska: 2 incidents; North Dakota: 2 incidents; Oregon: 2 incidents; Vermont: 2 incidents; Wyoming: 2 incidents; Delaware: 1 incident; Guam: 1 incident; Northern Mariana Islands: 1 incident; U.S. Virgin Islands: 1 incident 22 Texas 20 California 15 Georgia 14 Michigan 13 Florida 13 Massachusetts 13 Minnesota 10 Pennsylvania 9 Utah 9 Wisconsin 8 Illinois 8 Ohio 8 Virginia 7 Mississippi 7 New Jersey 7 North Carolina 6 Arizona 6 Missouri 6 Tennessee 5 Alabama 5 Indiana 5 Kansas 5 New York 5 Oklahoma 5 South Carolina 5 Washington 4 District of Columbia 4 Idaho 4 Iowa 4 New Hampshire 4 Puerto Rico 3 Arkansas 3 Colorado 3 Maine 3 Maryland 3 New Mexico 3 Rhode Island 3 South Dakota 3 West Virginia 2 Alaska 2 Connecticut 2 Louisiana 2 Montana 2 Nebraska 2 North Dakota 2 Oregon 2 Vermont 2 Wyoming 1 Delaware 1 Guam 1 Northern Mariana Islands 1 U.S. Virgin Islands

All 52 affected states and territories are shown.

  1. Texas 22 10%
  2. California 20 9%
  3. Georgia 15 7%
  4. Michigan 14 6%
  5. Florida 13 6%
  6. Massachusetts 13 6%
  7. Minnesota 13 6%
  8. Pennsylvania 10 4%

Counties

  1. Kent County, Michigan 6 3%
  2. Los Angeles County, California 6 3%
  3. Maricopa County, Arizona 5 2%
  4. Middlesex County, Massachusetts 5 2%
  5. Salt Lake County, Utah 5 2%

Showing 5 of 57 counties with repeated impact. 4 counties tied at 4 incidents; this tied group is not shown. 238 additional counties each appeared in one incident.

Cities

  1. Los Angeles, California 5 2%
  2. Washington, District of Columbia 4 2%

Showing 2 of 34 cities with repeated impact. 8 cities tied at 3 incidents; this tied group is not shown. 430 additional cities each appeared in one incident.

Concentration

State-by-sector matrix

Each incident is counted once per state-sector pair.

Incident counts by state or territory and critical infrastructure sector
State or territoryGovernment Services and FacilitiesHealthcare and Public HealthInformation TechnologyWater and Wastewater SystemsEmergency ServicesFinancial Services
Texas1143—11
California834——1
Georgia6213—2
Michigan3313—1
Florida522—11
Massachusetts632—2—
Minnesota5214——
Pennsylvania72———1
Affected ecosystem

Organizations and infrastructure

Organizations with repeated impact

Explore
  1. Winona County 2 1%

242 additional organizations each appeared in one incident.

Organization types

  1. General Government Administration 84 37%
  2. Local / municipal / county government administration 76 34%
  3. Public Education 41 18%
  4. K-12 school district / LEA 30 13%
  5. Information Technology & Telecom 23 10%
  6. Public Utilities & Infrastructure Operators 18 8%
  7. Public water / wastewater utilities 15 7%

3 organization types tied at 14 incidents; this tied group is not shown.

Critical infrastructure sectors

  1. Government Services and Facilities 123 55%
  2. Healthcare and Public Health 27 12%
  3. Information Technology 18 8%
  4. Water and Wastewater Systems 16 7%
  5. Emergency Services 11 5%
  6. Financial Services 10 4%
  7. Commercial Facilities 8 4%
  8. Transportation Systems 6 3%

Incident status

  1. Presumed Resolved 101 45%
  2. Resolved 87 39%
  3. Active 24 11%
  4. Presumed Active 13 6%
Characteristics

Mechanisms and impacts

Explore relationships

Attack mechanisms

  1. Unknown cyber mechanism 100 44%
  2. Unauthorized access 74 33%
  3. Ransomware 51 23%
  4. Malware 14 6%
  5. Data extortion 10 4%
  6. Vulnerability exploitation 8 4%
  7. Credential compromise 6 3%
  8. Website defacement 4 2%

Operational impacts

  1. Internal systems unavailable 119 53%
  2. Partial service outage 77 34%
  3. Network outage 73 32%
  4. Customer or public access restricted 66 29%
  5. Government services disrupted 64 28%
  6. Alternate service channel required 60 27%
  7. Manual workaround required 59 26%

3 impacts tied at 42 incidents; this tied group is not shown.

Data impacts

  1. Unknown data impact 94 42%
  2. Data unavailable 74 33%
  3. Data theft or exfiltration 36 16%
  4. Unauthorized data access 27 12%
  5. No known data impact 18 8%
  6. Data encryption 16 7%
  7. Data publication or leak 10 4%

3 impacts tied at 4 incidents; this tied group is not shown.

Extortion indicators

  1. No known extortion indicator 76 34%
  2. Leak-site listing 63 28%
  3. Unknown extortion indicators 44 20%
  4. Public leak threat 28 12%
  5. Data-theft extortion 27 12%
  6. Ransom demand 26 12%
  7. Countdown or payment deadline 17 8%
  8. Direct victim contact 15 7%
Public record

Assessment and transparency

Cyber assessment

  1. Confirmed 221 98%
  2. Suspected 2 1%
  3. Unresolved 2 1%

Ransomware confidence

  1. Unresolved 98 44%
  2. Confirmed 41 18%
  3. Not Ransomware 29 13%
  4. Low 27 12%
  5. Medium 18 8%
  6. High 11 5%
  7. Suspected 1 0%

Cyber transparency

  1. Official cyber 188 84%

    The organization publicly identifies the event as cyber-related.

  2. External cyber → official 21 9%

    External sources identified the event as cyber-related before the organization publicly confirmed it.

  3. External cyber only 11 5%

    Only external sources publicly identify the event as cyber-related.

  4. Cyber determination pending 4 2%

    The disruption is documented, but available public information does not yet establish cyber involvement.

Disruption transparency

  1. Official disruption 210 93%

    The organization publicly documents the resulting service disruption.

  2. External disruption only 8 4%

    Credible external sources document the disruption, but the organization does not clearly do so.

  3. No disruption cues 7 3%

    No credible public source clearly documents service disruption.

How these figures are calculated

Figures describe published registry coverage, not the prevalence of cyber incidents overall. Incidents are grouped by their canonical incident date rather than publication date.

An incident is counted once within each category. Geographic totals use explicitly impacted incident locations and do not treat an organization headquarters as an impacted place. Municipal impacts roll up to their recorded county and state, with each incident counted once per place. Affected organization counts use primary, victim, operator and owner relationships. Critical infrastructure and organization taxonomies remain separate.

Threat actor figures include only actors attached through eligible public claims. Same-date disclosure compares the calendar date of the first public signal with the calendar date of the official cyber disclosure; it does not measure elapsed hours or response speed. Mean days to later disclosure is the arithmetic mean only among valid intervals greater than zero, so longer intervals have more influence. Missing, invalid or reverse-ordered date pairs are excluded. Empty or unknown values are not inferred.

Registry data last updated Oct 8, 2026.