Skip to content

Which companies just had a verified incident, who lends to them and who owns them. Every claim carries its evidence level and its source. How we decide what is confirmed

DFX Cyber Intelligence · United States

US Critical Infrastructure Cyber Intelligence

Early warning, active monitoring, verified incidents and infrastructure dependencies. Provider status posts are shown as what the provider published; only analyst-reviewed findings are called cyber incidents.

Reduced coverageLast successful collection Nov 6 21:45 UTCLast attempt Nov 6 21:45 UTCLatest provider update Nov 6 17:59 UTC19 of 22 sources collected in the last 30 minutes; 3 not checked (robots.txt could not be read)Coverage and health

Coverage is reduced: DFX is not reading 105 of 124 status feeds, because their robots.txt does not allow it or could not be read, while we move to the incident feeds providers publish.

Filtered to all sectors, CA. Clear filters

Confirmed cyber incidents
11
Analyst-confirmed, activity in the last 90 days
Active confirmed disruptions
8
Confirmed and still not recovered
Unexplained disruptions
2
Cause not established; not called cyber
Remediation and recovery actions
30
Documented containment, resets, restoration
Providers monitored
19
Status feed collected in the last 30 minutes
New developments, 24h
129
Provider status updates first seen in 24h

Where the findings are

Shaded by the number of public findings in each state. A filled marker means the finding documents a site in that state; a ring means it is placed by headquarters only, which says nothing about the area around it. Select a state to filter the page.

Alaska: 0 public findingsAlabama: 0 public findingsArkansas: 1 public findingArizona: 0 public findingsCalifornia: 8 public findingsColorado: 1 public findingConnecticut: 1 public findingDistrict of Columbia: 0 public findingsDelaware: 0 public findingsFlorida: 1 public findingGeorgia: 0 public findingsHawaii: 0 public findingsIowa: 0 public findingsIdaho: 0 public findingsIllinois: 1 public findingIndiana: 1 public findingKansas: 0 public findingsKentucky: 0 public findingsLouisiana: 0 public findingsMassachusetts: 0 public findingsMaryland: 0 public findingsMaine: 0 public findingsMichigan: 0 public findingsMinnesota: 0 public findingsMissouri: 0 public findingsMississippi: 2 public findingsMontana: 0 public findingsNorth Carolina: 0 public findingsNorth Dakota: 0 public findingsNebraska: 0 public findingsNew Hampshire: 0 public findingsNew Jersey: 0 public findingsNew Mexico: 0 public findingsNevada: 0 public findingsNew York: 3 public findingsOhio: 2 public findingsOklahoma: 0 public findingsOregon: 0 public findingsPennsylvania: 0 public findingsRhode Island: 0 public findingsSouth Carolina: 0 public findingsSouth Dakota: 0 public findingsTennessee: 1 public findingTexas: 0 public findingsUtah: 0 public findingsVirginia: 3 public findingsVermont: 0 public findingsWashington: 0 public findingsWisconsin: 0 public findingsWest Virginia: 0 public findingsWyoming: 0 public findings
Confirmed, documented incident site in state Confirmed, placed by headquarters only Unexplained or other public findingNational platforms with no single location are listed below the map, not placed on it.

Confirmed cyber incidents

Incidents confirmed by the organisation, a regulator or compelling corroborated evidence, reviewed by an analyst. Live provider posts never enter this list on their own.

  • GitBook
    Cloud, identity and critical software · CA (headquarters)

    Redeployment with new secrets from 3 Nov 02:34Z; all existing API tokens invalidated and personal API tokens revoked; GitHub app keys rotated 10:52Z; all secrets rotated by 11:56Z; GitLab Git Sync tokens rotated 22:51Z. Customers told to rotate integration and third-party secrets. A dependent, Trade.xyz, publicly...

    A ConfirmedRecovered
    Event Nov 2
    First public Nov 2
    Acknowledged Nov 2
    GitBook
  • BankMobile Disbursements
    Payments · CA

    Ongoing manual operations: the California Community Colleges Chancellor's Office directed districts to pause electronic disbursements through BM Technologies and use paper checks or other methods; still in effect in window, no resumption date. Started before the window (directive early October).

    B Strongly corroboratedOngoing
    Event Oct 2 00:00 UTC
    First public Oct 2
    Acknowledged unknown
    Sacramento Bee via Yahoo News
  • WorkOS
    Cloud, identity and critical software · CA (headquarters)

    External access to the affected application disabled; access controls on internal tools reviewed. Founder says 'fully contained'. No credential rotation or session revocation mentioned publicly.

    A ConfirmedOngoing
    Event Oct 30
    First public Nov 2
    Acknowledged Nov 2
    WorkOS

Still not recovered from an earlier confirmed incident: BankMobile Disbursements, WorkOS.

Emerging operational signals

What providers published on their own status pages in this window, with the kind of wording they used. A disruption, a restriction or even security language is a provider statement, not a DFX finding that an attack occurred.

  • CloudflareCloud, identity and critical software
    Posted Nov 6 17:47 UTC · identified · minor impact

    Fedramp Customers have Delayed Purges

    Service restricted or degradedProvider status post
  • MercuryPayments
    Posted Nov 6 16:47 UTC · resolved

    Card Authorization Timeouts Impacting Some Customers

    Service restricted or degradedRestoration reported
  • MercuryPayments
    Posted Nov 6 16:46 UTC · resolved

    Logins Intermittently Interrupted for Some Customers

    Service restricted or degradedSign-in disruptionRestoration reported
  • CloudflareCloud, identity and critical software
    Posted Nov 6 09:47 UTC · resolved · minor impact

    Wrangler Deployments, Pages, and Workers Builds failures

    Investigation mentionedRestoration reportedProvider status post
  • CloudflareCloud, identity and critical software
    Posted Nov 6 08:54 UTC · resolved · minor impact

    Network Performance Issues in Singapore

    Investigation mentionedRestoration reportedProvider status post
  • TwilioTelecommunications
    Posted Nov 6 06:07 UTC · monitoring

    Notification Delivery Logs Unavailable in Console

    Service restricted or degradedProvider status post
  • TwilioTelecommunications
    Posted Nov 6 05:33 UTC · resolved · minor impact

    Notification Logs Unavailable in Console

    Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
  • ZoomCloud, identity and critical software
    Posted Nov 6 03:32 UTC · resolved · minor impact

    Service Degradation Affecting Zoom Mail, Calendar and Scheduler.

    Investigation mentionedRestoration reportedProvider status post
  • TwilioTelecommunications
    Posted Nov 6 01:23 UTC · resolved · minor impact

    SMS Delivery Delays Between Twilio and T-Mobile in Czech Republic

    Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
  • GitHubCloud, identity and critical software
    Posted Nov 5 23:36 UTC · resolved · minor impact

    Degraded performance for multiple GitHub services

    Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
  • TwilioTelecommunications
    Posted Nov 5 23:33 UTC · identified · minor impact

    Voice Call Silent and One-Way Audio Between a Subset of Twilio Phone Numbers and Colombia

    Investigation mentionedProvider status post
  • TwilioTelecommunications
    Posted Nov 5 22:50 UTC · identified · minor impact

    SMS Delivery Receipt Delays from a Subset of Twilio Short Codes to Liberty Puerto Rico

    Service restricted or degradedInvestigation mentionedProvider status post
  • TwilioTelecommunications
    Posted Nov 5 20:25 UTC · resolved · minor impact

    SMS Delivery Failures from Twilio Phone Numbers to Lycamobile France

    Investigation mentionedRestoration reportedProvider status post
  • RenderCloud, identity and critical software
    Posted Nov 5 20:12 UTC · resolved · minor impact

    Issues affecting connections to a subset of Postgres Databases

    Restoration reportedProvider status post
  • CloudflareCloud, identity and critical software
    Posted Nov 5 19:51 UTC · resolved · minor impact

    Workers Builds Issues

    Investigation mentionedProvider status post
  • TwilioTelecommunications
    Posted Nov 5 18:34 UTC · identified · minor impact

    Voice Call Failures from a Subset of Twilio Phone Numbers to Telefonica Argentina

    Investigation mentionedProvider status post
  • VercelCloud, identity and critical software
    Posted Nov 5 18:25 UTC · resolved · minor impact

    Build delays and degraded Vercel Dashboard performance

    Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
  • GitHubCloud, identity and critical software
    Posted Nov 5 16:50 UTC · resolved · minor impact

    Incident with Actions

    Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
  • PowerSchoolPublic institutions
    Posted Nov 5 16:40 UTC · monitoring · minor impact

    Naviance - Issues with student roster

    Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
  • CloudflareCloud, identity and critical software
    Posted Nov 5 15:05 UTC · resolved · minor impact

    Network disruption across multiple colocations in India

    Service restricted or degradedRestoration reportedProvider status post
  • TwilioTelecommunications
    Posted Nov 5 14:15 UTC · resolved · minor impact

    Voice Call Post Dial Delay from a Subset of Twilio Canada Phone Numbers to Rogers Wireless and Fido Canada

    Service restricted or degradedRestoration reportedProvider status post
  • CloudflareCloud, identity and critical software
    Posted Nov 5 13:23 UTC · resolved · minor impact

    Increased Errors for Durable Objects in Western Europe

    Investigation mentionedRestoration reportedProvider status post
  • AlpacaOther
    Posted Nov 4 22:29 UTC · identified · minor impact

    Delayed crypto deposits and withdrawals: third-party provider outage

    Service restricted or degradedRestoration reportedProvider status post
  • CloudflareCloud, identity and critical software
    Posted Nov 4 22:21 UTC · resolved

    Increased Errors for Durable Objects and Downstream Services in Eastern North America (ENAM)

    Restoration reportedProvider status post
  • SquarePayments
    Posted Nov 4 21:22 UTC · resolved · minor impact

    Service Disruption

    Service restricted or degradedRestoration reported
  • SegmentCloud, identity and critical software
    Posted Nov 4 20:17 UTC · resolved · minor impact

    Delays to Realtime Audiences and Journeys

    Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
  • SquarePayments
    Posted Nov 4 19:27 UTC · resolved · minor impact

    Service Disruption

    Service restricted or degradedRestoration reported
  • DialpadTelecommunications
    Posted Nov 4 18:40 UTC · resolved · minor impact

    Some customers may be experiencing degraded performance with AI agents.

    Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
  • TwilioTelecommunications
    Posted Nov 4 18:20 UTC · resolved · minor impact

    Search Delays on Enterprise Knowledge

    Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
  • TwilioTelecommunications
    Posted Nov 4 17:54 UTC · resolved · minor impact

    Delayed Email Validation History

    Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
  • GitHubCloud, identity and critical software
    Posted Nov 4 17:40 UTC · resolved · major impact

    Incident with Actions

    Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
  • NetlifyCloud, identity and critical software
    Posted Nov 4 17:15 UTC · resolved · minor impact

    Elevated build and deploy failures

    Restoration reportedProvider status post
  • TwilioTelecommunications
    Posted Nov 4 17:15 UTC · resolved · minor impact

    SMS Delivery Delays from Twilio to Claro Brazil

    Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
  • PlaidPayments
    Posted Nov 4 16:41 UTC · resolved · major impact

    Transfer RTP Requests are Temporarily Disabled for Some Customers

    Service taken offlineRestoration reported
  • PowerSchoolPublic institutions
    Posted Nov 4 16:30 UTC · identified · minor impact

    HigherEd - functionality issues

    Service restricted or degradedInvestigation mentionedProvider status post
  • GitHubCloud, identity and critical software
    Posted Nov 4 16:05 UTC · resolved · major impact

    Incident with Actions and Pages

    Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
  • TwilioTelecommunications
    Posted Nov 4 16:02 UTC · resolved · minor impact

    SMS Delivery Delays from Twilio to Algar Telecom Brazil

    Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
  • ShippoLogistics and transportation
    Posted Nov 4 14:50 UTC · resolved

    USPS Service Degradation

    Restoration reportedProvider status post
  • CloudflareCloud, identity and critical software
    Posted Nov 4 14:43 UTC · resolved · minor impact

    Increased Latency and Errors for R2 and Downstream Services in Western North America (WNAM)

    Restoration reportedProvider status post
  • CloudflareCloud, identity and critical software
    Posted Nov 4 13:39 UTC · resolved · minor impact

    Network latency issues in NRT

    Investigation mentionedRestoration reportedProvider status post

50 provider status incidents are open right now across monitored providers.

Unexplained disruptions

Verifiable operational disruptions with no established cause. Listed factually, without any claim of compromise.

None published in this window.

National timeline

Research findings and significant provider posts in date order. Event, first public observation and acknowledgement dates are kept separate on each record's page.

  1. Nov 4 17:40 UTC · Provider status post
    GitHub: Incident with Actions
  2. Nov 4 16:41 UTC · Provider status post
    Plaid: Transfer RTP Requests are Temporarily Disabled for Some Customers
  3. Nov 4 16:05 UTC · Provider status post
    GitHub: Incident with Actions and Pages
  4. Nov 3 · Research finding
    Caltrain: State AG breach posting in window. Incident date n/a on CA list; posted 2026-11-03; records not stated. Incident date not given.
  5. Nov 2 20:34 UTC · Research finding
    Mercury ACH duplicates: Duplicated incoming ACH transactions in some accounts; resolved 3 Nov 20:00Z; Mercury attributes it to 'a processing error on our end'.
  6. Nov 2 · Research finding
    Frontier Morongo Basin: Basin-wide internet outage affecting thousands of customers from 30 Oct; some service returned late 1 Nov. Verizon spokesperson: vandals...
  7. Nov 2 · Research finding
    WorkOS: External access to the affected application disabled; access controls on internal tools reviewed. Founder says 'fully contained'. No...
  8. Nov 2 · Research finding
    GitBook: Redeployment with new secrets from 3 Nov 02:34Z; all existing API tokens invalidated and personal API tokens revoked; GitHub app keys...
  9. Oct 30 · Research finding
    Hippo: State AG breach posting in window. Incident date 2025-01-30; posted 2026-10-30; records 176,128 total (IN AG). Disclosure lag about 638...
  10. Oct 30 · Research finding
    El Camino Health: State AG breach posting in window. Incident date 2026-08-26 / 2026-09-02; posted 2026-10-30; records not stated. Disclosure lag about 58...
  11. Oct 29 · Research finding
    Del Monte Foods: State AG breach posting in window. Incident date 2026-02-07; posted 2026-10-29; records 27,092 total (IN AG). Disclosure lag about 264 days.
  12. Oct 29 · Research finding
    Revolve: 8-K Item 8.01 (not 1.05) dated 2026-10-29, filed 2026-10-30: 'recently became aware of unauthorized access to certain of its systems',...
  13. Oct 2 · Research finding
    BankMobile Disbursements: Ongoing manual operations: the California Community Colleges Chancellor's Office directed districts to pause electronic disbursements...

Critical infrastructure sectors

Banking
1
Monitored
0
Confirmed
1
Unexplained
1
Open posts
Abrigo: Borrower-facing functionality is unavailable (Nov 3 13:00 UTC)
Payments
7
Monitored
1
Confirmed
1
Unexplained
9
Open posts
Mercury: Card Authorization Timeouts Impacting Some Customers (Nov 6 16:47 UTC)
Energy and electric utilities
0
Monitored
0
Confirmed
0
Unexplained
0
Open posts
No provider in this sector is monitored yet
Logistics and transportation
0
Monitored
1
Confirmed
0
Unexplained
2
Open posts
EasyPost: Delays accessing postage labels and account data (Nov 4 16:47 UTC)
Food and agriculture
0
Monitored
0
Confirmed
0
Unexplained
2
Open posts
Lightspeed: A possible delay for Nov 4 2026 payouts may be experienced by a... (Nov 5 18:01 UTC)
Telecommunications
1
Monitored
0
Confirmed
0
Unexplained
5
Open posts
Twilio: Notification Delivery Logs Unavailable in Console (Nov 6 06:07 UTC)
Water and wastewater
0
Monitored
0
Confirmed
0
Unexplained
0
Open posts
No provider in this sector is monitored yet
Healthcare
1
Monitored
1
Confirmed
0
Unexplained
0
Open posts
Healthie: DoseSpot service degradation (Nov 5 15:43 UTC)
Cloud, identity and critical software
4
Monitored
5
Confirmed
0
Unexplained
21
Open posts
Cloudflare: Fedramp Customers have Delayed Purges (Nov 6 17:47 UTC)
Public institutions
2
Monitored
2
Confirmed
0
Unexplained
4
Open posts
Blackbaud: Active Issue Alert – Blackbaud Tuition Management - #000701382 (Nov 5 18:57 UTC)

Dependencies and downstream exposure

Documented relationships between providers and the organisations that rely on them, from vendor case studies, customer releases, regulator orders and breach notices. A relationship is not an impact: each dependent says whether impact is confirmed.

Continental Utility Solutions, Inc. (CIS/billing vendor)
recovered
  • Kempner WSC TXNo confirmed impact
  • Culleoka WSC TXNo confirmed impact
  • McCoy WSC TXNo confirmed impact
  • Penrose WD CONo confirmed impact
  • Pleasant Valley MWC CANo confirmed impact
  • Village of Hopedale ILNo confirmed impact
Abrigo (Sageworks)
Provider outage; Abrigo's status page states no cause
  • Broadway Bank (San Antonio)No confirmed impact
  • Webster BankNo confirmed impact
  • Capital Credit Union (WI)No confirmed impact
  • Signature Bank of Georgia (ABA release May 2025, reported)No confirmed impact
TruStage
ongoing partial service, page updated 4 Nov
  • CrossState CU Association membersNo confirmed impact
  • America First CUNo confirmed impact
  • Greater Nevada CUNo confirmed impact
  • America's Credit UnionNo confirmed impact
BankMobile Disbursements (BM Technologies)
ongoing, electronic disbursements paused, Los Rios switched to Nelnet
  • Los Rios CCDNo confirmed impact
  • Santa Monica CollegeNo confirmed impact
  • about 60 California community college districtsNo confirmed impact
unnamed (SmartHub app channel affected; vendor hypothesized)
unknown
  • Joe Wheeler EMCNo confirmed impact
  • Huntsville UtilitiesNo confirmed impact
  • Decatur UtilitiesNo confirmed impact
Southern Company shared portal
unknown
  • Georgia PowerNo confirmed impact
  • Alabama PowerNo confirmed impact
  • Mississippi PowerNo confirmed impact
Pepco
recovered
  • U.S. State Department Foggy Bottom facilitiesNo confirmed impact
  • George Washington UniversityNo confirmed impact
  • DC traffic signalsNo confirmed impact
GitBook
verified (customer-wide revocation); hypothesized (Trade.xyz link)
  • All GitBook customers (API tokens invalidated, secrets rotation...No confirmed impact
  • one unnamed targeted customerNo confirmed impact
  • possibly Trade.xyzImpact reported publicly
Global financial service disruptionsInfrastructure WatchMonitoring coverage and healthHow this works and what it cannot seeResearch baseline: Operation Early Warning, 29 Oct to 5 Nov 2026 (50 public findings).