DysruptionHub registry intelligence

Registry insights

See where documented incidents concentrate, who they affect and how their characteristics change over time.

150 Incidents Documented in this reporting window

167 Affected organizations Linked across 150 incidents

45 States and territories With documented impact

395 Impacted locations Distinct places linked to incidents

47 Attributed incidents 31% name a threat actor

28 Active or presumed active 19% of incidents in this period

Tempo

Incident activity

150 incidents dated in this period

Attribution and disclosure

31% with a named threat actor in the registry 47 of 150 incidents

96% with a recorded official cyber disclosure 144 of 150 incidents

53% officially disclosed on the first-signal date 76 of 144 incidents with comparable dates

8.3 mean days to later official disclosure Across 68 incidents disclosed after the first-signal date

Threat actors

Explore

Interlock 8 5%
Qilin 6 4%
INC Ransom 4 3%
LockBit 3 2%
NightSpire 3 2%
ShinyHunters 3 2%
The Gentlemen 3 2%

5 threat actors tied at 2 incidents; this tied group is not shown.

Footprint

Geographic impact

Explore the incident map

Counties

Showing 6 of 35 counties with repeated impact. 29 counties tied at 2 incidents; this tied group is not shown. 175 additional counties each appeared in one incident.

Cities

Showing 3 of 24 cities with repeated impact. 21 cities tied at 2 incidents; this tied group is not shown. 300 additional cities each appeared in one incident.

Concentration

State-by-sector matrix

Each incident is counted once per state-sector pair.

Incident counts by state or territory and critical infrastructure sector
State or territory	Government Services and Facilities	Healthcare and Public Health	Water and Wastewater Systems	Information Technology	Commercial Facilities	Emergency Services
Texas	9	2	—	2	—	1
Minnesota	5	1	4	1	1	—
Georgia	4	1	3	1	—	—
Michigan	3	3	—	1	1	—
California	4	1	—	—	1	—
Florida	4	1	—	1	1	—
Massachusetts	3	1	—	2	—	2
Utah	—	1	—	4	1	—

Affected ecosystem

Organizations and infrastructure

Organizations with repeated impact

Explore

Winona County 2 1%

166 additional organizations each appeared in one incident.

Characteristics

Mechanisms and impacts

Explore relationships

Attack mechanisms

Operational impacts

Internal systems unavailable 83 55%
Partial service outage 57 38%
Customer or public access restricted 54 36%
Network outage 53 35%
Alternate service channel required 46 31%
Government services disrupted 45 30%
Manual workaround required 45 30%

2 impacts tied at 32 incidents; this tied group is not shown.

Data impacts

2 impacts tied at 3 incidents; this tied group is not shown.

Extortion indicators

2 indicators tied at 8 incidents; this tied group is not shown.

Public record

Assessment and transparency

Cyber assessment

Confirmed 149 99%
Unresolved 1 1%

Ransomware confidence

Unresolved 64 43%
Confirmed 27 18%
Not Ransomware 24 16%
Low 16 11%
Medium 13 9%
High 6 4%

Cyber transparency

Official cyber 131 87%

The organization publicly identifies the event as cyber-related.
External cyber → official 11 7%

External sources identified the event as cyber-related before the organization publicly confirmed it.
External cyber only 6 4%

Only external sources publicly identify the event as cyber-related.
Cyber determination pending 1 1%

The disruption is documented, but available public information does not yet establish cyber involvement.

Disruption transparency

Official disruption 140 93%

The organization publicly documents the resulting service disruption.
External disruption only 7 5%

Credible external sources document the disruption, but the organization does not clearly do so.
No disruption cues 3 2%

No credible public source clearly documents service disruption.

How these figures are calculated

Figures describe published registry coverage, not the prevalence of cyber incidents overall. Incidents are grouped by their canonical incident date rather than publication date.

An incident is counted once within each category. Geographic totals use explicitly impacted incident locations and do not treat an organization headquarters as an impacted place. Municipal impacts roll up to their recorded county and state, with each incident counted once per place. Affected organization counts use primary, victim, operator and owner relationships. Critical infrastructure and organization taxonomies remain separate.

Threat actor figures include only actors attached through eligible public claims. Same-date disclosure compares the calendar date of the first public signal with the calendar date of the official cyber disclosure; it does not measure elapsed hours or response speed. Mean days to later disclosure is the arithmetic mean only among valid intervals greater than zero, so longer intervals have more influence. Missing, invalid or reverse-ordered date pairs are excluded. Empty or unknown values are not inferred.

Registry data last updated Aug 24, 2026.