US Critical Infrastructure Cyber Intelligence

Where the findings are

Shaded by the number of public findings in each state. A filled marker means the finding documents a site in that state; a ring means it is placed by headquarters only, which says nothing about the area around it. Select a state to filter the page.

Confirmed cyber incidents

Incidents confirmed by the organisation, a regulator or compelling corroborated evidence, reviewed by an analyst. Live provider posts never enter this list on their own.

• GitBook

  Cloud, identity and critical software · CA (headquarters)

  Redeployment with new secrets from 3 Nov 02:34Z; all existing API tokens invalidated and personal API tokens revoked; GitHub app keys rotated 10:52Z; all secrets rotated by 11:56Z; GitLab Git Sync tokens rotated 22:51Z. Customers told to rotate integration and third-party secrets. A dependent, Trade.xyz, publicly...

  A ConfirmedRecovered

  Event Nov 2

  First public Nov 2

  Acknowledged Nov 2

  GitBook

• Abrigo Sageworks

  Banking · VA (headquarters)

  Communication channel escalation: from 17:27Z Abrigo said notices go to 'all Product and IT & Security contacts' at each institution, and from 1 Nov told customers to 'check your email for more specific details'. Routing to IT and security contacts is a detection-stage tell visible on the public page.

  A ConfirmedOngoing

  Event Oct 30 14:58 UTC

  First public Oct 30

  Acknowledged Oct 30

  Abrigo status page (Statuspage...

• University Hospitals Cleveland

  Healthcare · OH

  Public incident page wording drift. Initial: 'On Thursday, Oct. 22, 2026, we detected unusual activity... out of an abundance of caution, disconnected our systems from the internet.' Oct 26 (Cleveland 19): investigating with outside experts, 'significant progress over the weekend in restoring its systems to full...

  A ConfirmedOngoing

  Event Oct 22

  First public Oct 22

  Acknowledged Oct 22

  University Hospitals

• Queens Public Library

  Public institutions · NY

  Queens Public Library, which serves about 2.3 million people through more than 60 locations, told patrons and posted on social media on the evening of 4 Nov 2026 that its network and systems were down, and The Register reports the library confirmed a ransomware attack. Website, on-site computers, self-checkout and...

  B Strongly corroboratedOngoing

  Event unknown

  First public Nov 4

  Acknowledged Nov 4

  The Register

• DreamHost

  Cloud, identity and critical software · National or unlocated

  In-window notice (29 Oct): vulnerability addressed, File Manager rebuilt with monitoring, internal credentials rotated, outside forensics retained, affected server preserved, regulators being notified.

  A ConfirmedOngoing

  Event Aug 15

  First public Oct 23

  Acknowledged Oct 23

  DreamHost

• Granicus

  Public institutions · CO (headquarters)

  Granicus, whose govAccess Vision content management system runs websites for many US local governments, posted on its own status page on 29 Oct 2026 that it detected malicious activity targeted at Vision's public file upload function and disabled that function on all Vision websites until further notice, after a...

  A ConfirmedOngoing

  Event Oct 29 11:06 UTC

  First public Oct 29 11:06 UTC

  Acknowledged Oct 29 19:48 UTC

  Granicus status page: Vision...

• WorkOS

  Cloud, identity and critical software · CA (headquarters)

  External access to the affected application disabled; access controls on internal tools reviewed. Founder says 'fully contained'. No credential rotation or session revocation mentioned publicly.

  A ConfirmedOngoing

  Event Oct 30

  First public Nov 2

  Acknowledged Nov 2

  WorkOS

• J.B. Hunt

  Logistics and transportation · AR (headquarters)

  Company: 'Our systems remain operational, and there has been no disruption to our ability to serve customers.' No freight disruption observed or alleged. Data-exposure event, not an operational outage.

  A ConfirmedOngoing

  Event unknown

  First public Oct 23

  Acknowledged Oct 29

  The Loadstar

• Name.com DNS hijack

  Cloud, identity and critical software · National or unlocated

  15 client domains improperly redirected (at least 12 DeFi front ends, 10 tied to Vercel) to Step Drainer pages; Name.com restored domains, enhanced client account security, urged DNS review and 2FA. About USD 138K stolen (The Block). Re-verified 5 Nov: no root-cause report or later update found in window.

  A ConfirmedRecovered

  Event Oct 31 01:00 UTC

  First public Oct 31

  Acknowledged Oct 31

  Crypto Briefing

• Vicksburg MS utility billing

  Public institutions · MS (headquarters)

  Prior register (snippet only, KTVE/KARD report dated 2026-11-02): utility payment processing resumed Fri 2026-10-30, about 95% of systems restored, late fees waived and shutoffs delayed. Article returned HTTP 403 on fetch, so these details are unverified by this lane.

  A ConfirmedOngoing

  Event Oct 1

  First public Oct 27

  Acknowledged Oct 27

  Vicksburg Daily News

• Kernel

  Cloud, identity and critical software · National or unlocated

  Compromised API key revoked 2 Nov 22:30Z. Second wave 3 Nov 05:41 to 07:17Z (cryptominer on servers); all hosting-provider API keys rotated 07:37Z; servers taken offline 07:46Z and 09:29Z; containment ended 22:50Z.

  A ConfirmedRecovered

  Event Oct 24 21:18 UTC

  First public Nov 2 19:28 UTC

  Acknowledged Nov 4

  Kernel

• Finzly

  Banking · NC (headquarters)

  Finzly confirmed an unauthorized third party accessed 'a single device in our backup data center containing configuration information', said it rotated system keys and credentials (timing not stated), notified law enforcement, engaged outside legal and forensic experts, and is working with regulators; no evidence...

  A Confirmedunknown

  Event Oct 15 00:00 UTC

  First public Oct 20 00:00 UTC

  Acknowledged Oct 30 16:12 UTC

  American Banker

• Seminole County Clerk

  Public institutions · FL

  Intrusion found Wednesday 2026-10-28 5 p.m.; offices closed to the public Friday 2026-10-30; internet access and other systems shut off as a precaution; outside expert team brought in; Clerk Grant Maloy: no data encrypted, does not appear to be ransomware; courts open for injunctions and probate. No restoration update...

  A Confirmedunknown

  Event Oct 28 21:00 UTC

  First public Oct 29

  Acknowledged Oct 29

  Spectrum News 13

• Turning Stone

  Other · NY

  Company 'proactively shut down certain systems as a precaution to help protect our guest information' (2026-11-02), working with cybersecurity experts. Nov 3: cash-only, ATMs offline, TS Rewards, bingo, sports books closed. Nov 4 service update: 'We've restored several services since our last update and expect more to...

  A ConfirmedOngoing

  Event Nov 2

  First public Nov 2

  Acknowledged Nov 2

  Turning Stone Enterprises

• mSecure

  Cloud, identity and critical software · OR (headquarters)

  Notice to current and former customers 2026-11-03: 'recently learned of suspicious activity associated with the mSecure password management application', 'quickly launched an investigation, took steps to mitigate the issue', engaged external cybersecurity experts. Advice: change passwords, reset or re-enroll 2FA,...

  A ConfirmedOngoing

  Event Nov 3

  First public Nov 3

  Acknowledged Nov 3

  BleepingComputer

• UT Arlington

  Other · TX

  Cybersecurity incident 2026-10-27 made MachForms and other web pages/IT systems unavailable; university engaged cybersecurity experts and law enforcement; live FAQ still listed MachForms unavailable on 2026-11-04 (per DysruptionHub preview; university wording not verified first-hand).

  B Strongly corroboratedOngoing

  Event Oct 27

  First public Oct 27

  Acknowledged unknown

  DysruptionHub

• Florida DOE aid portal

  Public institutions · FL (headquarters)

  Unauthorized access to student financial aid portal discovered 2026-10-19; disclosed 2026-10-29; may have exposed data on nearly 5 million people including SSNs (Fox 13 via KonBriefing).

  A ConfirmedOngoing

  Event Oct 19

  First public Oct 29

  Acknowledged Oct 29

  Fox 13

Still not recovered from an earlier confirmed incident: Abrigo Sageworks, University Hospitals Cleveland, BankMobile Disbursements, Queens Public Library, DreamHost, Granicus, WorkOS, J.B. Hunt, Vicksburg MS utility billing, Turning Stone, mSecure, UT Arlington, Florida DOE aid portal.

Emerging operational signals

What providers published on their own status pages in this window, with the kind of wording they used. A disruption, a restriction or even security language is a provider statement, not a DFX finding that an attack occurred.

• MercuryPayments

  Posted Nov 6 16:47 UTC · resolved

  Card Authorization Timeouts Impacting Some Customers

  Service restricted or degradedRestoration reported
• MercuryPayments

  Posted Nov 6 16:46 UTC · resolved

  Logins Intermittently Interrupted for Some Customers

  Service restricted or degradedSign-in disruptionRestoration reported
• CloudflareCloud, identity and critical software

  Posted Nov 6 09:47 UTC · resolved · minor impact

  Wrangler Deployments, Pages, and Workers Builds failures

  Investigation mentionedRestoration reportedProvider status post
• CloudflareCloud, identity and critical software

  Posted Nov 6 08:54 UTC · resolved · minor impact

  Network Performance Issues in Singapore

  Investigation mentionedRestoration reportedProvider status post
• XenditPayments

  Posted Nov 6 08:46 UTC · resolved · minor impact

  PAYLATER KREDIVO Indonesia Disruption

  Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
• FlutterwavePayments

  Posted Nov 6 06:56 UTC · resolved · major impact

  [NGN] Service Restored: Intermittent Card Transaction Failures

  Restoration reportedProvider status post
• XenditPayments

  Posted Nov 6 06:40 UTC · resolved · minor impact

  Payouts Disruption in Indonesia

  Service restricted or degradedRestoration reportedProvider status post
• XenditPayments

  Posted Nov 6 06:17 UTC · resolved · minor impact

  QR_CODE DANA Indonesia Disruption

  Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
• XenditPayments

  Posted Nov 6 06:14 UTC · resolved · minor impact

  EWALLET DANA Indonesia Disruption

  Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
• TwilioTelecommunications

  Posted Nov 6 06:07 UTC · monitoring

  Notification Delivery Logs Unavailable in Console

  Service restricted or degradedProvider status post
• SendGridCloud, identity and critical software

  Posted Nov 6 06:07 UTC · monitoring

  Notification Delivery Logs Unavailable in Console

  Service restricted or degradedProvider status post
• TwilioTelecommunications

  Posted Nov 6 05:33 UTC · resolved · minor impact

  Notification Logs Unavailable in Console

  Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
• SendGridCloud, identity and critical software

  Posted Nov 6 05:33 UTC · resolved · minor impact

  Notification Logs Unavailable in Console

  Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
• ZoomCloud, identity and critical software

  Posted Nov 6 03:32 UTC · resolved · minor impact

  Service Degradation Affecting Zoom Mail, Calendar and Scheduler.

  Investigation mentionedRestoration reportedProvider status post
• TwilioTelecommunications

  Posted Nov 6 01:23 UTC · resolved · minor impact

  SMS Delivery Delays Between Twilio and T-Mobile in Czech Republic

  Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
• SendGridCloud, identity and critical software

  Posted Nov 6 01:23 UTC · resolved · minor impact

  SMS Delivery Delays Between Twilio and T-Mobile in Czech Republic

  Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
• GitHubCloud, identity and critical software

  Posted Nov 5 23:36 UTC · resolved · minor impact

  Degraded performance for multiple GitHub services

  Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
• TwilioTelecommunications

  Posted Nov 5 23:33 UTC · identified · minor impact

  Voice Call Silent and One-Way Audio Between a Subset of Twilio Phone Numbers and Colombia

  Investigation mentionedProvider status post
• SendGridCloud, identity and critical software

  Posted Nov 5 23:33 UTC · identified · minor impact

  Voice Call Silent and One-Way Audio Between a Subset of Twilio Phone Numbers and Colombia

  Investigation mentionedProvider status post
• SupabaseCloud, identity and critical software

  Posted Nov 5 23:12 UTC · resolved · minor impact

  Intermittent 502/503 errors for pg_net calls to Edge Functions

  Restoration reported
• TwilioTelecommunications

  Posted Nov 5 22:50 UTC · identified · minor impact

  SMS Delivery Receipt Delays from a Subset of Twilio Short Codes to Liberty Puerto Rico

  Service restricted or degradedInvestigation mentionedProvider status post
• SendGridCloud, identity and critical software

  Posted Nov 5 22:50 UTC · identified · minor impact

  SMS Delivery Receipt Delays from a Subset of Twilio Short Codes to Liberty Puerto Rico

  Service restricted or degradedInvestigation mentionedProvider status post
• CirclePayments

  Posted Nov 5 22:32 UTC · resolved · major impact

  USDC on edgeX — Mainnet outage

  Service restricted or degradedRestoration reportedProvider status post
• ToastPayments

  Posted Nov 5 22:25 UTC · resolved · minor impact

  Toast IQ Query Failures

  Restoration reportedProvider status post
• FlutterwavePayments

  Posted Nov 5 22:19 UTC · identified · major impact

  [NGN, GHS] Service Alert: Pending Payouts on Flutterwave for Business (F4B)

  No classified wordingProvider status post
• XenditPayments

  Posted Nov 5 21:50 UTC · resolved · minor impact

  EWALLET TRUEMONEY Thailand Disruption

  Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
• XenditPayments

  Posted Nov 5 21:30 UTC · resolved · minor impact

  Payouts Disruption in Indonesia

  Service restricted or degradedRestoration reportedProvider status post
• WorldpayPayments

  Posted Nov 5 20:46 UTC · resolved · minor impact

  INC0719188 We are aware of an incident affecting payments processing through the Alternative Payment Method (APM) – eps.

  Restoration reportedProvider status post
• Mercado PagoPayments

  Posted Nov 5 20:42 UTC · resolved · major impact

  ALL SITES - Delay in Webhook Payments notifications

  Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
• Mercado PagoPayments

  Posted Nov 5 20:42 UTC · resolved · major impact

  ALL SITES - Delay in IPN Payments notifications

  Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
• TwilioTelecommunications

  Posted Nov 5 20:25 UTC · resolved · minor impact

  SMS Delivery Failures from Twilio Phone Numbers to Lycamobile France

  Investigation mentionedRestoration reportedProvider status post
• SendGridCloud, identity and critical software

  Posted Nov 5 20:25 UTC · resolved · minor impact

  SMS Delivery Failures from Twilio Phone Numbers to Lycamobile France

  Investigation mentionedRestoration reportedProvider status post
• RenderCloud, identity and critical software

  Posted Nov 5 20:12 UTC · resolved · minor impact

  Issues affecting connections to a subset of Postgres Databases

  Restoration reportedProvider status post
• CloudflareCloud, identity and critical software

  Posted Nov 5 19:51 UTC · resolved · minor impact

  Workers Builds Issues

  Investigation mentionedProvider status post
• BlackbaudPublic institutions

  Posted Nov 5 18:57 UTC · resolved · minor impact

  Active Issue Alert – Blackbaud Tuition Management - #000701382

  Restoration reportedProvider status post
• TwilioTelecommunications

  Posted Nov 5 18:34 UTC · identified · minor impact

  Voice Call Failures from a Subset of Twilio Phone Numbers to Telefonica Argentina

  Investigation mentionedProvider status post
• SendGridCloud, identity and critical software

  Posted Nov 5 18:34 UTC · identified · minor impact

  Voice Call Failures from a Subset of Twilio Phone Numbers to Telefonica Argentina

  Investigation mentionedProvider status post
• VercelCloud, identity and critical software

  Posted Nov 5 18:25 UTC · resolved · minor impact

  Build delays and degraded Vercel Dashboard performance

  Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
• FlutterwavePayments

  Posted Nov 5 18:15 UTC · resolved · major impact

  Service Restored: BIN Service Disruption – Impact on Card Transactions

  Service restricted or degradedInvestigation mentionedRestoration reportedProvider status post
• LightspeedFood and agriculture

  Posted Nov 5 18:01 UTC · monitoring · minor impact

  A possible delay for Nov 4 2026 payouts may be experienced by a subset of L & K series merchants

  Service restricted or degradedProvider status post

49 provider status incidents are open right now across monitored providers.

Unexplained disruptions

Verifiable operational disruptions with no established cause. Listed factually, without any claim of compromise.

• GiveX (Shift4)

  Payments · National or unlocated

  'Shift4 is aware of some merchants experiencing issues with GiveX. We are entering a preventative maintenance window immediately. During this time, no GiveX service will be available.' Merchant-side issues preceded the take-down.

  C Unexplained disruptionOngoing

  Event Oct 31 18:28 UTC

  First public Oct 31 18:28 UTC

  Acknowledged Oct 31 18:28 UTC

  Shift4 status page (Statuspage...

National timeline

Research findings and significant provider posts in date order. Event, first public observation and acknowledgement dates are kept separate on each record's page.

1. Nov 6 06:56 UTC · Provider status post
   Flutterwave: [NGN] Service Restored: Intermittent Card Transaction Failures
2. Nov 5 22:32 UTC · Provider status post
   Circle: USDC on edgeX — Mainnet outage
3. Nov 5 22:19 UTC · Provider status post
   Flutterwave: [NGN, GHS] Service Alert: Pending Payouts on Flutterwave for Business (F4B)
4. Nov 5 20:42 UTC · Provider status post
   Mercado Pago: ALL SITES - Delay in Webhook Payments notifications
5. Nov 5 20:42 UTC · Provider status post
   Mercado Pago: ALL SITES - Delay in IPN Payments notifications
6. Nov 5 18:15 UTC · Provider status post
   Flutterwave: Service Restored: BIN Service Disruption – Impact on Card Transactions
7. Nov 5 · Research finding
   ERCOT maintenance: Noise control. Market notices announce planned maintenance on 2026-11-05: EMS, MMS, ITRON and EIN applications 15:30 to 18:00 CT; MIS...
8. Nov 4 · Research finding
   AT&T Aledo fiber cut: Home phone and internet outage in 76008 ZIP; AT&T cited a fiber cut and crews restoring.
9. Nov 4 · Research finding
   Kernel: Compromised API key revoked 2 Nov 22:30Z. Second wave 3 Nov 05:41 to 07:17Z (cryptominer on servers); all hosting-provider API keys rotated...
10. Nov 4 · Research finding
    Queens Public Library: Queens Public Library, which serves about 2.3 million people through more than 60 locations, told patrons and posted on social media on the...
11. Nov 3 · Research finding
    Caltrain: State AG breach posting in window. Incident date n/a on CA list; posted 2026-11-03; records not stated. Incident date not given.
12. Nov 3 · Research finding
    mSecure: Notice to current and former customers 2026-11-03: 'recently learned of suspicious activity associated with the mSecure password management...
13. Nov 2 20:34 UTC · Research finding
    Mercury ACH duplicates: Duplicated incoming ACH transactions in some accounts; resolved 3 Nov 20:00Z; Mercury attributes it to 'a processing error on our end'.
14. Nov 2 · Research finding
    Frontier Morongo Basin: Basin-wide internet outage affecting thousands of customers from 30 Oct; some service returned late 1 Nov. Verizon spokesperson: vandals...
15. Nov 2 · Research finding
    CT DSS via Gainwell: 41,000 Medicaid recipients affected after an unauthorized user accessed a Medicaid provider reimbursement account; DSS informed by fiscal...
16. Nov 2 · Research finding
    Cognitive Health Technologies: Health IT consulting firm; intrusion 5 Feb to 28 Apr 2026, detected 27 Apr; substitute notice; 49,467 affected; reported by HIPAA Journal 2...
17. Nov 2 · Research finding
    Apex Clean Energy: State AG breach posting in window. Incident date not stated on VT list; posted 2026-11-02; records 9 VT residents. Incident date not given.
18. Nov 2 · Research finding
    UMMC: State AG breach posting in window. Incident date 2026-02-11 / 2026-02-19; posted 2026-11-02; records 17 VT residents. Disclosure lag about...
19. Nov 2 · Research finding
    Turning Stone: Company 'proactively shut down certain systems as a precaution to help protect our guest information' (2026-11-02), working with...
20. Nov 2 · Research finding
    WorkOS: External access to the affected application disabled; access controls on internal tools reviewed. Founder says 'fully contained'. No...
21. Nov 2 · Research finding
    GitBook: Redeployment with new secrets from 3 Nov 02:34Z; all existing API tokens invalidated and personal API tokens revoked; GitHub app keys...
22. Oct 31 18:28 UTC · Research finding
    GiveX (Shift4): 'Shift4 is aware of some merchants experiencing issues with GiveX. We are entering a preventative maintenance window immediately. During...
23. Oct 31 · Research finding
    Name.com DNS hijack: 15 client domains improperly redirected (at least 12 DeFi front ends, 10 tied to Vercel) to Step Drainer pages; Name.com restored domains,...
24. Oct 30 16:12 UTC · Research finding
    Finzly: Finzly confirmed an unauthorized third party accessed 'a single device in our backup data center containing configuration information',...
25. Oct 30 · Research finding
    Alaska windstorm: Weather outage, non-cyber control. More than 47,000 customers out as of 09:00 AKDT Friday 2026-10-30 from Willow and Wasilla to Anchorage...
26. Oct 30 · Research finding
    Uber Freight: State AG breach posting in window. Incident date 2026-07-11; posted 2026-10-30; records 494 total (IN AG). Disclosure lag about 111 days.
27. Oct 30 · Research finding
    Hippo: State AG breach posting in window. Incident date 2025-01-30; posted 2026-10-30; records 176,128 total (IN AG). Disclosure lag about 638...
28. Oct 30 · Research finding
    El Camino Health: State AG breach posting in window. Incident date 2026-08-26 / 2026-09-02; posted 2026-10-30; records not stated. Disclosure lag about 58...
29. Oct 30 · Research finding
    Baanx US: Baanx reset passwords and two-factor authentication for all Crypto Life accounts; users must complete reset to regain access before...
30. Oct 30 · Research finding
    Abrigo Sageworks: Communication channel escalation: from 17:27Z Abrigo said notices go to 'all Product and IT & Security contacts' at each institution, and...

Critical infrastructure sectors

Dependencies and downstream exposure

Documented relationships between providers and the organisations that rely on them, from vendor case studies, customer releases, regulator orders and breach notices. A relationship is not an impact: each dependent says whether impact is confirmed.