Skip to content

Which companies just had a verified incident, who lends to them and who owns them. Every claim carries its evidence level and its source. How we decide what is confirmed

DFX Cyber Intelligence · United States

US Critical Infrastructure Cyber Intelligence

Early warning, active monitoring, verified incidents and infrastructure dependencies. Provider status posts are shown as what the provider published; only analyst-reviewed findings are called cyber incidents.

Reduced coverageLast successful collection Nov 6 21:55 UTCLast attempt Nov 6 21:55 UTCLatest provider update Nov 6 17:59 UTC19 of 22 sources collected in the last 30 minutes; 3 not checked (robots.txt could not be read)Coverage and health

Coverage is reduced: DFX is not reading 105 of 124 status feeds, because their robots.txt does not allow it or could not be read, while we move to the incident feeds providers publish.

Filtered to all sectors, OH. Clear filters

Confirmed cyber incidents
9
Analyst-confirmed, activity in the last 30 days
Active confirmed disruptions
7
Confirmed and still not recovered
Unexplained disruptions
2
Cause not established; not called cyber
Remediation and recovery actions
25
Documented containment, resets, restoration
Providers monitored
19
Status feed collected in the last 30 minutes
New developments, 24h
124
Provider status updates first seen in 24h

Where the findings are

Shaded by the number of public findings in each state. A filled marker means the finding documents a site in that state; a ring means it is placed by headquarters only, which says nothing about the area around it. Select a state to filter the page.

Alaska: 0 public findingsAlabama: 0 public findingsArkansas: 0 public findingsArizona: 0 public findingsCalifornia: 7 public findingsColorado: 1 public findingConnecticut: 0 public findingsDistrict of Columbia: 0 public findingsDelaware: 0 public findingsFlorida: 0 public findingsGeorgia: 0 public findingsHawaii: 0 public findingsIowa: 0 public findingsIdaho: 0 public findingsIllinois: 1 public findingIndiana: 1 public findingKansas: 0 public findingsKentucky: 0 public findingsLouisiana: 0 public findingsMassachusetts: 0 public findingsMaryland: 0 public findingsMaine: 0 public findingsMichigan: 0 public findingsMinnesota: 0 public findingsMissouri: 0 public findingsMississippi: 2 public findingsMontana: 0 public findingsNorth Carolina: 0 public findingsNorth Dakota: 0 public findingsNebraska: 0 public findingsNew Hampshire: 0 public findingsNew Jersey: 0 public findingsNew Mexico: 0 public findingsNevada: 0 public findingsNew York: 2 public findingsOhio: 2 public findingsOklahoma: 0 public findingsOregon: 0 public findingsPennsylvania: 0 public findingsRhode Island: 0 public findingsSouth Carolina: 0 public findingsSouth Dakota: 0 public findingsTennessee: 1 public findingTexas: 0 public findingsUtah: 0 public findingsVirginia: 3 public findingsVermont: 0 public findingsWashington: 0 public findingsWisconsin: 0 public findingsWest Virginia: 0 public findingsWyoming: 0 public findings
Confirmed, documented incident site in state Confirmed, placed by headquarters only Unexplained or other public findingNational platforms with no single location are listed below the map, not placed on it.

Confirmed cyber incidents

Incidents confirmed by the organisation, a regulator or compelling corroborated evidence, reviewed by an analyst. Live provider posts never enter this list on their own.

  • University Hospitals Cleveland
    Healthcare · OH

    Public incident page wording drift. Initial: 'On Thursday, Oct. 22, 2026, we detected unusual activity... out of an abundance of caution, disconnected our systems from the internet.' Oct 26 (Cleveland 19): investigating with outside experts, 'significant progress over the weekend in restoring its systems to full...

    A ConfirmedOngoing
    Event Oct 22
    First public Oct 22
    Acknowledged Oct 22
    University Hospitals

Still not recovered from an earlier confirmed incident: University Hospitals Cleveland.

Emerging operational signals

What providers published on their own status pages in this window, with the kind of wording they used. A disruption, a restriction or even security language is a provider statement, not a DFX finding that an attack occurred.

  • WorldpayPayments
    Posted Nov 5 20:46 UTC · resolved · minor impact

    INC0719188 We are aware of an incident affecting payments processing through the Alternative Payment Method (APM) – eps.

    Restoration reportedProvider status post
  • WorldpayPayments
    Posted Nov 5 17:46 UTC · resolved · minor impact

    INC0719027 - Worldwide Payment Gateway (WPG) - Mastercard and Visa dual-branded Carte Bancaire

    Restoration reportedProvider status post
  • WorldpayPayments
    Posted Nov 5 14:16 UTC · resolved · minor impact

    INC0718854 - Worldwide Payment Gateway (WPG)

    Restoration reportedProvider status post
  • WorldpayPayments
    Posted Nov 5 10:55 UTC · resolved

    INC0718658 - We have resolved issues with Authorization & Payments.

    Restoration reportedProvider status post
  • WorldpayPayments
    Posted Nov 5 06:57 UTC · resolved · minor impact

    INC0718460 - We are aware of potential issues with a Third Party

    Restoration reportedProvider status post
  • WorldpayPayments
    Posted Nov 4 16:45 UTC · resolved · minor impact

    INC0716317 - GPPaaS PayPal Direct - Funding Delay

    Service restricted or degradedRestoration reportedProvider status post
  • WorldpayPayments
    Posted Nov 3 10:55 UTC · resolved

    INC0716051 - 3D Secure is resolved.

    Restoration reportedProvider status post
  • WorldpayPayments
    Posted Nov 3 10:29 UTC · resolved

    INC0716043 - We have resolved issues with Acquiring Services

    Restoration reportedProvider status post
  • WorldpayPayments
    Posted Nov 3 06:07 UTC · resolved

    INC0714904 - We have resolved issues with Acquiring Services

    Restoration reportedProvider status post
  • WorldpayPayments
    Posted Nov 3 05:46 UTC · resolved

    INC0714904 - We have resolved issues with Authorization & Payments.

    Restoration reportedProvider status post
  • WorldpayPayments
    Posted Nov 2 14:47 UTC · resolved · minor impact

    INC0714252 - We are investigating potential issues with Portals & Reporting

    Investigation mentionedRestoration reportedProvider status post
  • WorldpayPayments
    Posted Nov 1 21:38 UTC · resolved · minor impact

    INC0713314 - We are aware of potential issues with a Third Party

    Restoration reportedProvider status post
  • WorldpayPayments
    Posted Nov 1 12:12 UTC · resolved

    INC0713069 - We have resolved issues with Authorization & Payments.

    Restoration reportedProvider status post
  • WorldpayPayments
    Posted Nov 1 08:42 UTC · resolved · minor impact

    INC0712171 - We are aware of potential issues with a Third Party

    Restoration reportedProvider status post
  • WorldpayPayments
    Posted Oct 29 21:43 UTC · resolved · minor impact

    INC0709613 - WPG - Maintenance Extended - Degradation of service

    Restoration reportedProvider status post

50 provider status incidents are open right now across monitored providers.

Unexplained disruptions

Verifiable operational disruptions with no established cause. Listed factually, without any claim of compromise.

None published in this window.

National timeline

Research findings and significant provider posts in date order. Event, first public observation and acknowledgement dates are kept separate on each record's page.

  1. Oct 22 · Research finding
    University Hospitals Cleveland: Public incident page wording drift. Initial: 'On Thursday, Oct. 22, 2026, we detected unusual activity... out of an abundance of caution,...
  2. Oct 21 · Research finding
    TAKKT Foodservices NA: Order processing, deliveries and invoicing remain limited in Foodservices North America; most webshops and communication channels used to...
  3. Oct 15 · Research finding
    Central Ohio Primary Care: Voice-phishing access to files with PHI (Aug 2026), about 1.4M notified per press; CA AG listing reported 30 Oct (in window); lawsuits...

Critical infrastructure sectors

Banking
1
Monitored
0
Confirmed
1
Unexplained
1
Open posts
Abrigo: Borrower-facing functionality is unavailable (Nov 3 13:00 UTC)
Payments
7
Monitored
0
Confirmed
1
Unexplained
9
Open posts
Mercury: Card Authorization Timeouts Impacting Some Customers (Nov 6 16:47 UTC)
Energy and electric utilities
0
Monitored
0
Confirmed
0
Unexplained
0
Open posts
No provider in this sector is monitored yet
Logistics and transportation
0
Monitored
0
Confirmed
0
Unexplained
2
Open posts
EasyPost: Delays accessing postage labels and account data (Nov 4 16:47 UTC)
Food and agriculture
0
Monitored
0
Confirmed
0
Unexplained
2
Open posts
Lightspeed: A possible delay for Nov 4 2026 payouts may be experienced by a... (Nov 5 18:01 UTC)
Telecommunications
1
Monitored
0
Confirmed
0
Unexplained
5
Open posts
Twilio: Notification Delivery Logs Unavailable in Console (Nov 6 06:07 UTC)
Water and wastewater
0
Monitored
0
Confirmed
0
Unexplained
0
Open posts
No provider in this sector is monitored yet
Healthcare
1
Monitored
1
Confirmed
0
Unexplained
0
Open posts
Healthie: DoseSpot service degradation (Nov 5 15:43 UTC)
Cloud, identity and critical software
4
Monitored
5
Confirmed
0
Unexplained
21
Open posts
Cloudflare: Fedramp Customers have Delayed Purges (Nov 6 17:47 UTC)
Public institutions
2
Monitored
2
Confirmed
0
Unexplained
4
Open posts
Blackbaud: Active Issue Alert – Blackbaud Tuition Management - #000701382 (Nov 5 18:57 UTC)

Dependencies and downstream exposure

Documented relationships between providers and the organisations that rely on them, from vendor case studies, customer releases, regulator orders and breach notices. A relationship is not an impact: each dependent says whether impact is confirmed.

Continental Utility Solutions, Inc. (CIS/billing vendor)
recovered
  • Kempner WSC TXNo confirmed impact
  • Culleoka WSC TXNo confirmed impact
  • McCoy WSC TXNo confirmed impact
  • Penrose WD CONo confirmed impact
  • Pleasant Valley MWC CANo confirmed impact
  • Village of Hopedale ILNo confirmed impact
Abrigo (Sageworks)
Provider outage; Abrigo's status page states no cause
  • Broadway Bank (San Antonio)No confirmed impact
  • Webster BankNo confirmed impact
  • Capital Credit Union (WI)No confirmed impact
  • Signature Bank of Georgia (ABA release May 2025, reported)No confirmed impact
BankMobile Disbursements (BM Technologies)
ongoing, electronic disbursements paused, Los Rios switched to Nelnet
  • Los Rios CCDNo confirmed impact
  • Santa Monica CollegeNo confirmed impact
  • about 60 California community college districtsNo confirmed impact
unnamed (SmartHub app channel affected; vendor hypothesized)
unknown
  • Joe Wheeler EMCNo confirmed impact
  • Huntsville UtilitiesNo confirmed impact
  • Decatur UtilitiesNo confirmed impact
Southern Company shared portal
unknown
  • Georgia PowerNo confirmed impact
  • Alabama PowerNo confirmed impact
  • Mississippi PowerNo confirmed impact
Pepco
recovered
  • U.S. State Department Foggy Bottom facilitiesNo confirmed impact
  • George Washington UniversityNo confirmed impact
  • DC traffic signalsNo confirmed impact
GitBook
verified (customer-wide revocation); hypothesized (Trade.xyz link)
  • All GitBook customers (API tokens invalidated, secrets rotation...No confirmed impact
  • one unnamed targeted customerNo confirmed impact
  • possibly Trade.xyzImpact reported publicly
Mercadien, P.C.
data incident, no operational impact
  • Bangkok Bank PCL NY BranchNo confirmed impact
  • Fairwinds Credit Union (Sep 2026 notice)No confirmed impact
Global financial service disruptionsInfrastructure WatchMonitoring coverage and healthHow this works and what it cannot seeResearch baseline: Operation Early Warning, 29 Oct to 5 Nov 2026 (41 public findings).