# Major cyber incidents — WATCH (stable)
id cyber · Technology & Cyber · horizon acute · checked 2026-11-01T11:52Z · at this level since 2026-10-31T11:26Z · stale after 2026-11-02T01:52Z
Assessed by an AI model (Anthropic Claude) against published rubrics; not a forecast or advice · CC BY 4.0 · https://canary.danleech.com/s/cyber

Value: US hospital systems disrupted
Rated on: Ransomware or attack disrupting a large company or critical service, or a mass-exploited zero-day.

Ransomware claims up 26% in October; US hospital systems disrupted

Why it's at this level: Ransomware leak-site claims rose 25.8% to 1,127 in October (HackerFeeds, 31 Oct), peaking on 26 Oct. University Hospitals (Cleveland) websites and portals were still down on 29 Oct after an incident, and a group claimed an attack on University of New Mexico hospitals (26 Oct); the university says core systems were not breached.

What this means for you: Be alert to phishing that exploits high-profile incidents. The NCSC publishes guidance for individuals and businesses.

Why it matters: Ransomware and state hacking now shut down hospitals, retailers, carmakers and airports for weeks.
What moves it: Ransomware gangs, state actors, zero-days, supply-chain compromises.

Rubric — Alert: National-scale attack on critical infrastructure (power, health, finance), or a destructive state-attributed attack. | Watch: Ransomware or attack disrupting a large company or critical service, or a mass-exploited zero-day. | Normal: No major incidents disrupting critical services this week.

Sources:
- Tech Insider — Ransomware attacks October 2026: 1,127 claims (2026-10-31) https://tech-insider.org/ransomware-attacks-october-2026-1127-claims-n0n-gentlemen-qilin-2026/
- Ideastream — Most University Hospitals websites still down (2026-10-29) https://ideastream.org/health/2026-10-29/most-university-hospitals-websites-still-down-a-week-after-cybersecurity-incident