OUTBREAK MONITORDATASET COVERAGE 2015–2026 · LAST EDITORIAL REVIEW 14 NOV 2026 · CLASSIFICATIONS ARE EDITORIAL, NOT OFFICIAL GOVERNMENT RATINGS$CYBERMC $30.1K24H VOL $105K

▍SITUATION REPORT // GLOBAL CYBER OUTBREAK

The next
pandemic is
digital.

A new era of global disruption. Cyberattacks are spreading across the infrastructure that powers modern civilization.

Tracking digital outbreaks, critical vulnerabilities, ransomware incidents, and emerging cyber threats around the world.

VIEW OUTBREAK TIMELINE OPEN OUTBREAK MAP

LOADING GEODATA…

L1 LOWL2 GUARDEDL3 ELEVATEDL4 CRITICAL· MARKERS = AFFECTED LOCATION

SELECT A MARKER ON THE GLOBE — OR CHOOSE BELOW

Global threat level

LEVEL 3— ELEVATED

Rule-based assessment of 18 eligible incidents, 14 NOV 2025 – 14 NOV 2026. Methodology →

Tracked incidents

Verified records in this dataset

Countries affected

Distinct affected countries

Critical infrastructure

Incidents involving essential services

Highest level recorded

No incident has met Level 5 criteria

SEC-02CLASSIFICATION PROTOCOL

Threat Levels

A five-stage editorial scale modelled on outbreak severity. It is Cyber Pandemic's own classification — not an official government threat rating.

LEVEL 1
LOW
Routine cyber activity. Limited impact with no demonstrated widespread disruption.
- Minor data breaches
- Isolated phishing campaigns
- Limited service interruptions
00 INCIDENTS IN DATASET
LEVEL 2
GUARDED
Elevated malicious activity with potential to affect multiple organizations.
- Coordinated phishing campaigns
- Exploitation of widely used software vulnerabilities
- Regional ransomware incidents
07 INCIDENTS IN DATASET
LEVEL 3CURRENT
ELEVATED
Significant cyber incidents affecting major organizations, multiple sectors, or important infrastructure.
- Major ransomware attacks
- Significant government network compromises
- Large-scale cloud service disruptions
59 INCIDENTS IN DATASET
LEVEL 4
CRITICAL
Severe cyber incidents with demonstrated widespread consequences or significant disruption to essential services.
- Major power infrastructure compromises
- Significant financial infrastructure disruption
- Multiple critical infrastructure organizations affected
10 INCIDENTS IN DATASET
LEVEL 5
PANDEMIC
A hypothetical or exceptional global cyber emergency involving widespread, interconnected disruption across multiple countries and critical infrastructure sectors.
- No incident in this database has ever met this designation.
Strict criteria — all required
- ■ Verified incidents across multiple countries
- ■ Multiple critical infrastructure sectors affected
- ■ Evidence of interconnected or coordinated disruption
- ■ Significant real-world operational consequences
- ■ Manual editorial approval — never assigned automatically or by media volume
00 INCIDENTS IN DATASET

HOW THE GLOBAL LEVEL IS CALCULATED

R1 Only malicious incidents with status confirmed or reported, dated in the trailing 365 days, are eligible. Outages and suspected/disputed incidents never raise the global level.
R2 No eligible incidents → Level 1.
R3 Otherwise, the base level is the highest level among eligible incidents.
R4 A global CRITICAL (Level 4) requires at least two Level-4 incidents across two or more countries.
R5 Level 5 is never assigned by rule — only by a recorded, named editorial decision against the strict criteria.
R6 The number of headlines or media attention is never an input.

Current assessment log

Highest eligible incident level in window: 4 (CRITICAL).
Global CRITICAL requires ≥2 Level-4 incidents across ≥2 countries; capped at Level 3.
Level 5 is never assigned by rule — only by recorded editorial approval.

WINDOW 14 NOV 2025 → 14 NOV 2026 · RULE LEVEL 3 · DISPLAYED LEVEL 3 (RULE)

Driving incidents

SEC-03OUTBREAK PROGRESSION

Infection Timeline

A chronological record of significant cyber incidents. Every entry is sourced to public reporting; verification status and the nature of each event (attack vs. non-malicious failure) are shown on the card.

76 / 76 CASES SHOWN

2026
13 NOV 2026
CASE #075
L4 · CRITICALCONFIRMEDNOT AN ATTACKCP-2026-018
FAA Nationwide Ground Stop
Region
United States
Sector
Transportation, Government
Attack type
Non-Malicious IT Failure
Critical infra
YES
The FAA halted departures at all U.S. airports on the afternoon of Nov 13, 2026 after communication problems hit multiple Air Route Traffic Control Centers (up to 17 of 22, per FAA Administrator Bryan Bedford); the stop was lifted that evening after roughly four to five hours. On Nov 14 Transportation Secretary Sean Duffy said a preliminary investigation pointed to a router that began flooding the network during an L3Harris contractor upgrade (copper-to-fiber work) at a remote FAA site, while Bedford said there was 'zero evidence' of anything nefarious; the exact root cause remains under investigation.
3 SOURCES
13 NOV 2026
CASE #076
L3 · ELEVATEDCONFIRMEDCP-2026-019
North Korean FaceStealer Crypto Theft Campaign
Region
United States
Sector
Finance, Technology
Attack type
Cryptocurrency Theft
Critical infra
NO
On Nov 13, 2026 the U.S. Justice Department and FBI disclosed that a North Korean social-engineering scheme they call FaceStealer had stolen more than $400 million in cryptocurrency over roughly 18 months by luring crypto holders and industry workers into fake video calls that deliver wallet-stealing malware. Announcing the theft figures, authorities said they had disrupted the scheme's cloud infrastructure and seized more than 900 victim webcam recordings.
3 SOURCES
12 NOV 2026
CASE #073
L3 · ELEVATEDCONFIRMEDNOT AN ATTACKCP-2026-016
Microsoft 365 / Exchange Online Global Outage
Region
United States
Sector
Technology
Attack type
Non-Malicious IT Failure
Critical infra
NO
Beginning on Nov 12, 2026 (first acknowledged for users in the Americas), Exchange Online/Outlook failed for users worldwide, also disrupting Exchange-dependent features of Teams, SharePoint and other Microsoft 365 services into Nov 13. Microsoft said the cause was 'a technical issue not related to cyber or AI', introduced during an earlier network capacity upgrade and surfacing after a later network change; a full post-incident report is pending.
3 SOURCES
12 NOV 2026
CASE #074
L3 · ELEVATEDCONFIRMEDCP-2026-017
Quantum Systems Cyberattack Grounds Bundeswehr Drones
Region
Germany
Sector
Defense, Manufacturing
Attack type
Supply-Chain Attack
Critical infra
YES
German military drone maker Quantum Systems confirmed it detected an 'active cyberattack by hostile actors' in October 2026; per the Financial Times and Der Spiegel, attackers reached its update server and pushed a malicious update for its QBase mission-planning software that reached customer servers, including the Bundeswehr's, but not the drones themselves. The company says the attack was contained, and Bamberg prosecutors opened an investigation against unknown persons.
3 SOURCES
09 NOV 2026
CASE #072
L3 · ELEVATEDCONFIRMEDCP-2026-015
Nitori Customer Data Breach
Region
Japan
Sector
Retail
Attack type
Data Breach
Critical infra
NO
Japanese furniture retailer Nitori Holdings disclosed on Nov 9, 2026 that unauthorized access confirmed on Nov 6 may have exposed up to 37.62 million personal-information records; log analysis indicated third-party access may also have occurred in mid-to-late October. Exposed fields may include names, addresses, phone numbers, email addresses, dates of birth and order data, but not passwords or card details.
2 SOURCES
30 OCT 2026
CASE #071
L2 · GUARDEDCONFIRMEDCP-2026-014
Check Point Gateway PHP2Shell Exploitation and ESXi Wiper Attacks
Region
Israel
Sector
Technology
Attack type
Wiper / Destructive Malware
Critical infra
NO
Check Point Research reported that attackers exploited PHP2Shell and a Gaia OS root-escalation flaw on unpatched Check Point gateways, in a first wave from Oct 30, 2026 against Israeli organizations in which some victims' VMware ESXi hosts were hit with a 'destroy_v6' wiper, and a second, non-destructive wave on Nov 2 across multiple countries and sectors. CISA added the Check Point privilege-escalation flaw (CVE-2026-123039) to its Known Exploited Vulnerabilities catalog on Nov 13, 2026.
3 SOURCES
29 OCT 2026
CASE #069
L3 · ELEVATEDCONFIRMEDCP-2026-008
Binance exchange theft
Region
United Arab Emirates
Sector
Finance
Attack type
Cryptocurrency Theft
Critical infra
NO
Attackers drained about $6.3 billion in virtual assets from Binance in what is reported as the largest cryptocurrency theft on record; the FBI attributed it to North Korea.
3 SOURCES
29 OCT 2026
CASE #070
L3 · ELEVATEDCONFIRMEDCP-2026-013
Florida Student Financial Aid Website Breach
Region
United States
Sector
Government, Education
Attack type
Data Breach
Critical infra
NO
The Florida Department of Education announced on Oct 29, 2026 that hackers gained unauthorized access to the state's student financial aid website, discovered on Oct 19, potentially exposing data on about 4.9 million people. The department has not said how the intrusion occurred, and no group had claimed it.
3 SOURCES
28 OCT 2026
CASE #068
L3 · ELEVATEDCONFIRMEDCP-2026-012
Arara Message Email Platform Breach (incl. City of Osaka)
Region
Japan
Sector
Technology, Government
Attack type
Data Breach
Critical infra
NO
Attackers breached Arara Message, an email-distribution service run by Paycloud Holdings subsidiary Arara, abused it to send about 7.13 million phishing emails from Oct 28–30, 2026, and took or may have taken about 77 million email addresses plus member data held for up to about 380 client organizations (Paycloud disclosure, Nov 2). Downstream victims include the City of Osaka, which said on Nov 13 that about 1.08 million email addresses from its online administrative-services system were exposed via contractor TKC's use of Arara.
3 SOURCES
26 OCT 2026
CASE #067
L2 · GUARDEDREPORTEDCP-2026-007
UNM Health cyberattack and ambulance diversion
Region
United States
Sector
Healthcare, Education
Attack type
Ransomware
Critical infra
YES
A cyberattack on the University of New Mexico's health system led it to divert ambulances, limit admissions and suspend outpatient surgeries and appointments; a new group called Byod claimed a ransomware attack.
3 SOURCES
22 OCT 2026
CASE #066
L3 · ELEVATEDCONFIRMEDCP-2026-011
University Hospitals (Cleveland) Cyberattack
Region
United States
Sector
Healthcare
Attack type
Infrastructure Compromise
Critical infra
YES
University Hospitals, a large Northeast Ohio health system, detected unusual activity on its servers on Oct 22, 2026 and disconnected its systems from the internet as a precaution. The system has not disclosed the nature of the attack, whether ransomware was involved, or whether data was accessed; no group has publicly claimed it.
3 SOURCES
15 OCT 2026
CASE #065
L3 · ELEVATEDCONFIRMEDCP-2026-010
ConnectWise Cloud Backup Supply-Chain Compromise
Region
United States
Sector
Technology
Attack type
Supply-Chain Attack
Critical infra
NO
In mid-October 2026 an attacker used a compromised credential belonging to ConnectWise's Cloud Backup (formerly SkyKick) application to access Microsoft 365 tenants of managed-service providers and their customers without user sign-ins. Microsoft attributed the campaign to Storm-0940, a China-linked group, and said it targeted more than 2,250 tenants, most attempts unsuccessful.
3 SOURCES
07 OCT 2026
CASE #064
L3 · ELEVATEDCONFIRMEDCP-2026-009
IDCF Cloud Ransomware Attack
Region
Japan
Sector
Technology, Government
Attack type
Ransomware
Critical infra
YES
On Oct 7, 2026 a ransomware attack on IDCF Cloud, run by SoftBank subsidiary IDC Frontier, stopped and encrypted virtual servers in four zones of its East Japan Region 1, affecting 495 companies and local governments. IDC Frontier said customer data in those zones is difficult to retrieve, found no evidence of exfiltration from customer virtual servers, and has not named an attacker.
2 SOURCES
05 OCT 2026
CASE #063
L3 · ELEVATEDCONFIRMEDCP-2026-006
Denmark Central Population Register (CPR) data breach
Region
Denmark
Sector
Government
Attack type
Data Breach
Critical infra
YES
Denmark disclosed that unauthorized parties used a private company's access to the national Central Population Register to extract names, addresses and CPR numbers of about 8.8 million living and deceased people.
3 SOURCES

SEC-04GEOSPATIAL SURVEILLANCE

Global Outbreak Map

Markers show where the affected organization or infrastructure is located — not where an attack originated. Shaded countries indicate how many tracked incidents affected them. Attribution, where it exists, is listed in each incident report.

COUNTRYFROMTO

76 INCIDENTS · 22 COUNTRIES · 2015–2026PROJ: NATURAL EARTH

LOADING GEODATA…

DENSITY1 → 43MARKER SIZE & COLOR = THREAT LEVELPULSE = LEVEL 4+

Incidents in view

SEC-05EPIDEMIOLOGY

Threat Analytics

Every chart is computed from the incident database on this page. This is a curated record of significant incidents — not a census of all cyberattacks — so counts describe this dataset, not global attack volumes.

REPORTING PERIOD→MALICIOUS INCIDENTS ONLYN = 76 · COVERAGE 23 DEC 2015 – 13 NOV 2026

Incidents by yearFIG.A

Threat-level distributionFIG.C

L1 LOW0
L2 GUARDED7
L3 ELEVATED59
L4 CRITICAL10
L5 PANDEMIC0

Incidents by sectorFIG.B

Incidents can affect several sectors.

Attack type distributionFIG.D

Global outbreak progressionFIG.E

Cumulative incidents recorded in this dataset over time.

SEC-06LATEST REPORTS · AUTO-REFRESH EVERY 30 MIN

Latest Outbreak Reports

Recent reporting aggregated from official agencies, vendor threat-intelligence teams and established security publications. Categories and signals are applied automatically and are preliminary — they are not editorial threat classifications.

FEED REFRESHED

14 NOV 2026 22:35 UTC

SOURCES ONLINE: CISA · CISA KEV Catalog · UK NCSC · Canadian Centre for Cyber Security · Microsoft Security · Google Threat Intelligence · The Record · BleepingComputer · SecurityWeek — UNREACHABLE: CERT-EU

Signals are automated & preliminary

SEC-07 · PATIENT ZERO PROTOCOL

The outbreak
has begun.

TRACK THE INFECTION. WATCH THE WORLD.

The world is connected. So is the threat. $CYBER is the community currency of the people watching the digital outbreak unfold — a meme about the internet, not a claim about any real emergency.

Market vitalsLIVE · DEXSCREENER

Market cap: $30.1K
24h volume: $105K
Price: $0.00003122
24h change: +7.95%
Liquidity: $11.3K
Pairs tracked: 1

SOURCE: DEXSCREENER · PRIMARY POOL PUMPSWAP · UPDATED 14 NOV 2026 22:35 UTC · REFRESHES EVERY 60S. 24H VOLUME SUMS ALL PAIRS.

BUY $CYBER DEXSCREENER

Token dossier● CONTRACT PUBLISHED

Token name: Cyber Pandemic
Ticker: $CYBER
Blockchain: Solana
Total supply: TBA
Contract address (CA): Gt1G6V5YEb9GyZzjq3wwxzDGU56BQwiK2eZP9dgFpump

DexScreener chart Block explorer X / Twitter · TBA Telegram · TBA

Speculative digital asset. No profit or investment return is guaranteed. Market figures are third-party data and can change rapidly. Only use the contract address published on this page.

OUTBREAK MONITORDATASET COVERAGE 2015–2026 · LAST EDITORIAL REVIEW 14 NOV 2026 · CLASSIFICATIONS ARE EDITORIAL, NOT OFFICIAL GOVERNMENT RATINGS$CYBERMC $30.1K24H VOL $105K

▍SITUATION REPORT // GLOBAL CYBER OUTBREAK

The next
pandemic is
digital.

A new era of global disruption. Cyberattacks are spreading across the infrastructure that powers modern civilization.

Tracking digital outbreaks, critical vulnerabilities, ransomware incidents, and emerging cyber threats around the world.

VIEW OUTBREAK TIMELINE OPEN OUTBREAK MAP

LOADING GEODATA…

L1 LOWL2 GUARDEDL3 ELEVATEDL4 CRITICAL· MARKERS = AFFECTED LOCATION

SELECT A MARKER ON THE GLOBE — OR CHOOSE BELOW

Global threat level

LEVEL 3— ELEVATED

Rule-based assessment of 18 eligible incidents, 14 NOV 2025 – 14 NOV 2026. Methodology →

Tracked incidents

Verified records in this dataset

Countries affected

Distinct affected countries

Critical infrastructure

Incidents involving essential services

Highest level recorded

No incident has met Level 5 criteria

SEC-02CLASSIFICATION PROTOCOL

Threat Levels

A five-stage editorial scale modelled on outbreak severity. It is Cyber Pandemic's own classification — not an official government threat rating.

LEVEL 1
LOW
Routine cyber activity. Limited impact with no demonstrated widespread disruption.
- Minor data breaches
- Isolated phishing campaigns
- Limited service interruptions
00 INCIDENTS IN DATASET
LEVEL 2
GUARDED
Elevated malicious activity with potential to affect multiple organizations.
- Coordinated phishing campaigns
- Exploitation of widely used software vulnerabilities
- Regional ransomware incidents
07 INCIDENTS IN DATASET
LEVEL 3CURRENT
ELEVATED
Significant cyber incidents affecting major organizations, multiple sectors, or important infrastructure.
- Major ransomware attacks
- Significant government network compromises
- Large-scale cloud service disruptions
59 INCIDENTS IN DATASET
LEVEL 4
CRITICAL
Severe cyber incidents with demonstrated widespread consequences or significant disruption to essential services.
- Major power infrastructure compromises
- Significant financial infrastructure disruption
- Multiple critical infrastructure organizations affected
10 INCIDENTS IN DATASET
LEVEL 5
PANDEMIC
A hypothetical or exceptional global cyber emergency involving widespread, interconnected disruption across multiple countries and critical infrastructure sectors.
- No incident in this database has ever met this designation.
Strict criteria — all required
- ■ Verified incidents across multiple countries
- ■ Multiple critical infrastructure sectors affected
- ■ Evidence of interconnected or coordinated disruption
- ■ Significant real-world operational consequences
- ■ Manual editorial approval — never assigned automatically or by media volume
00 INCIDENTS IN DATASET

HOW THE GLOBAL LEVEL IS CALCULATED

R1 Only malicious incidents with status confirmed or reported, dated in the trailing 365 days, are eligible. Outages and suspected/disputed incidents never raise the global level.
R2 No eligible incidents → Level 1.
R3 Otherwise, the base level is the highest level among eligible incidents.
R4 A global CRITICAL (Level 4) requires at least two Level-4 incidents across two or more countries.
R5 Level 5 is never assigned by rule — only by a recorded, named editorial decision against the strict criteria.
R6 The number of headlines or media attention is never an input.

Current assessment log

Highest eligible incident level in window: 4 (CRITICAL).
Global CRITICAL requires ≥2 Level-4 incidents across ≥2 countries; capped at Level 3.
Level 5 is never assigned by rule — only by recorded editorial approval.

WINDOW 14 NOV 2025 → 14 NOV 2026 · RULE LEVEL 3 · DISPLAYED LEVEL 3 (RULE)

Driving incidents

SEC-03OUTBREAK PROGRESSION

Infection Timeline

76 / 76 CASES SHOWN

2026
13 NOV 2026
CASE #075
L4 · CRITICALCONFIRMEDNOT AN ATTACKCP-2026-018
FAA Nationwide Ground Stop
Region
United States
Sector
Transportation, Government
Attack type
Non-Malicious IT Failure
Critical infra
YES
The FAA halted departures at all U.S. airports on the afternoon of Nov 13, 2026 after communication problems hit multiple Air Route Traffic Control Centers (up to 17 of 22, per FAA Administrator Bryan Bedford); the stop was lifted that evening after roughly four to five hours. On Nov 14 Transportation Secretary Sean Duffy said a preliminary investigation pointed to a router that began flooding the network during an L3Harris contractor upgrade (copper-to-fiber work) at a remote FAA site, while Bedford said there was 'zero evidence' of anything nefarious; the exact root cause remains under investigation.
3 SOURCES
13 NOV 2026
CASE #076
L3 · ELEVATEDCONFIRMEDCP-2026-019
North Korean FaceStealer Crypto Theft Campaign
Region
United States
Sector
Finance, Technology
Attack type
Cryptocurrency Theft
Critical infra
NO
On Nov 13, 2026 the U.S. Justice Department and FBI disclosed that a North Korean social-engineering scheme they call FaceStealer had stolen more than $400 million in cryptocurrency over roughly 18 months by luring crypto holders and industry workers into fake video calls that deliver wallet-stealing malware. Announcing the theft figures, authorities said they had disrupted the scheme's cloud infrastructure and seized more than 900 victim webcam recordings.
3 SOURCES
12 NOV 2026
CASE #073
L3 · ELEVATEDCONFIRMEDNOT AN ATTACKCP-2026-016
Microsoft 365 / Exchange Online Global Outage
Region
United States
Sector
Technology
Attack type
Non-Malicious IT Failure
Critical infra
NO
Beginning on Nov 12, 2026 (first acknowledged for users in the Americas), Exchange Online/Outlook failed for users worldwide, also disrupting Exchange-dependent features of Teams, SharePoint and other Microsoft 365 services into Nov 13. Microsoft said the cause was 'a technical issue not related to cyber or AI', introduced during an earlier network capacity upgrade and surfacing after a later network change; a full post-incident report is pending.
3 SOURCES
12 NOV 2026
CASE #074
L3 · ELEVATEDCONFIRMEDCP-2026-017
Quantum Systems Cyberattack Grounds Bundeswehr Drones
Region
Germany
Sector
Defense, Manufacturing
Attack type
Supply-Chain Attack
Critical infra
YES
German military drone maker Quantum Systems confirmed it detected an 'active cyberattack by hostile actors' in October 2026; per the Financial Times and Der Spiegel, attackers reached its update server and pushed a malicious update for its QBase mission-planning software that reached customer servers, including the Bundeswehr's, but not the drones themselves. The company says the attack was contained, and Bamberg prosecutors opened an investigation against unknown persons.
3 SOURCES
09 NOV 2026
CASE #072
L3 · ELEVATEDCONFIRMEDCP-2026-015
Nitori Customer Data Breach
Region
Japan
Sector
Retail
Attack type
Data Breach
Critical infra
NO
Japanese furniture retailer Nitori Holdings disclosed on Nov 9, 2026 that unauthorized access confirmed on Nov 6 may have exposed up to 37.62 million personal-information records; log analysis indicated third-party access may also have occurred in mid-to-late October. Exposed fields may include names, addresses, phone numbers, email addresses, dates of birth and order data, but not passwords or card details.
2 SOURCES
30 OCT 2026
CASE #071
L2 · GUARDEDCONFIRMEDCP-2026-014
Check Point Gateway PHP2Shell Exploitation and ESXi Wiper Attacks
Region
Israel
Sector
Technology
Attack type
Wiper / Destructive Malware
Critical infra
NO
Check Point Research reported that attackers exploited PHP2Shell and a Gaia OS root-escalation flaw on unpatched Check Point gateways, in a first wave from Oct 30, 2026 against Israeli organizations in which some victims' VMware ESXi hosts were hit with a 'destroy_v6' wiper, and a second, non-destructive wave on Nov 2 across multiple countries and sectors. CISA added the Check Point privilege-escalation flaw (CVE-2026-123039) to its Known Exploited Vulnerabilities catalog on Nov 13, 2026.
3 SOURCES
29 OCT 2026
CASE #069
L3 · ELEVATEDCONFIRMEDCP-2026-008
Binance exchange theft
Region
United Arab Emirates
Sector
Finance
Attack type
Cryptocurrency Theft
Critical infra
NO
Attackers drained about $6.3 billion in virtual assets from Binance in what is reported as the largest cryptocurrency theft on record; the FBI attributed it to North Korea.
3 SOURCES
29 OCT 2026
CASE #070
L3 · ELEVATEDCONFIRMEDCP-2026-013
Florida Student Financial Aid Website Breach
Region
United States
Sector
Government, Education
Attack type
Data Breach
Critical infra
NO
The Florida Department of Education announced on Oct 29, 2026 that hackers gained unauthorized access to the state's student financial aid website, discovered on Oct 19, potentially exposing data on about 4.9 million people. The department has not said how the intrusion occurred, and no group had claimed it.
3 SOURCES
28 OCT 2026
CASE #068
L3 · ELEVATEDCONFIRMEDCP-2026-012
Arara Message Email Platform Breach (incl. City of Osaka)
Region
Japan
Sector
Technology, Government
Attack type
Data Breach
Critical infra
NO
Attackers breached Arara Message, an email-distribution service run by Paycloud Holdings subsidiary Arara, abused it to send about 7.13 million phishing emails from Oct 28–30, 2026, and took or may have taken about 77 million email addresses plus member data held for up to about 380 client organizations (Paycloud disclosure, Nov 2). Downstream victims include the City of Osaka, which said on Nov 13 that about 1.08 million email addresses from its online administrative-services system were exposed via contractor TKC's use of Arara.
3 SOURCES
26 OCT 2026
CASE #067
L2 · GUARDEDREPORTEDCP-2026-007
UNM Health cyberattack and ambulance diversion
Region
United States
Sector
Healthcare, Education
Attack type
Ransomware
Critical infra
YES
A cyberattack on the University of New Mexico's health system led it to divert ambulances, limit admissions and suspend outpatient surgeries and appointments; a new group called Byod claimed a ransomware attack.
3 SOURCES
22 OCT 2026
CASE #066
L3 · ELEVATEDCONFIRMEDCP-2026-011
University Hospitals (Cleveland) Cyberattack
Region
United States
Sector
Healthcare
Attack type
Infrastructure Compromise
Critical infra
YES
University Hospitals, a large Northeast Ohio health system, detected unusual activity on its servers on Oct 22, 2026 and disconnected its systems from the internet as a precaution. The system has not disclosed the nature of the attack, whether ransomware was involved, or whether data was accessed; no group has publicly claimed it.
3 SOURCES
15 OCT 2026
CASE #065
L3 · ELEVATEDCONFIRMEDCP-2026-010
ConnectWise Cloud Backup Supply-Chain Compromise
Region
United States
Sector
Technology
Attack type
Supply-Chain Attack
Critical infra
NO
In mid-October 2026 an attacker used a compromised credential belonging to ConnectWise's Cloud Backup (formerly SkyKick) application to access Microsoft 365 tenants of managed-service providers and their customers without user sign-ins. Microsoft attributed the campaign to Storm-0940, a China-linked group, and said it targeted more than 2,250 tenants, most attempts unsuccessful.
3 SOURCES
07 OCT 2026
CASE #064
L3 · ELEVATEDCONFIRMEDCP-2026-009
IDCF Cloud Ransomware Attack
Region
Japan
Sector
Technology, Government
Attack type
Ransomware
Critical infra
YES
On Oct 7, 2026 a ransomware attack on IDCF Cloud, run by SoftBank subsidiary IDC Frontier, stopped and encrypted virtual servers in four zones of its East Japan Region 1, affecting 495 companies and local governments. IDC Frontier said customer data in those zones is difficult to retrieve, found no evidence of exfiltration from customer virtual servers, and has not named an attacker.
2 SOURCES
05 OCT 2026
CASE #063
L3 · ELEVATEDCONFIRMEDCP-2026-006
Denmark Central Population Register (CPR) data breach
Region
Denmark
Sector
Government
Attack type
Data Breach
Critical infra
YES
Denmark disclosed that unauthorized parties used a private company's access to the national Central Population Register to extract names, addresses and CPR numbers of about 8.8 million living and deceased people.
3 SOURCES

SEC-04GEOSPATIAL SURVEILLANCE

Global Outbreak Map

COUNTRYFROMTO

76 INCIDENTS · 22 COUNTRIES · 2015–2026PROJ: NATURAL EARTH

LOADING GEODATA…

DENSITY1 → 43MARKER SIZE & COLOR = THREAT LEVELPULSE = LEVEL 4+

Incidents in view

SEC-05EPIDEMIOLOGY

Threat Analytics

REPORTING PERIOD→MALICIOUS INCIDENTS ONLYN = 76 · COVERAGE 23 DEC 2015 – 13 NOV 2026

Incidents by yearFIG.A

Threat-level distributionFIG.C

L1 LOW0
L2 GUARDED7
L3 ELEVATED59
L4 CRITICAL10
L5 PANDEMIC0

Incidents by sectorFIG.B

Incidents can affect several sectors.

Attack type distributionFIG.D

Global outbreak progressionFIG.E

Cumulative incidents recorded in this dataset over time.

SEC-06LATEST REPORTS · AUTO-REFRESH EVERY 30 MIN

Latest Outbreak Reports

FEED REFRESHED

14 NOV 2026 22:35 UTC

Signals are automated & preliminary

SEC-07 · PATIENT ZERO PROTOCOL

The outbreak
has begun.

TRACK THE INFECTION. WATCH THE WORLD.

The world is connected. So is the threat. $CYBER is the community currency of the people watching the digital outbreak unfold — a meme about the internet, not a claim about any real emergency.

Market vitalsLIVE · DEXSCREENER

Market cap: $30.1K
24h volume: $105K
Price: $0.00003122
24h change: +7.95%
Liquidity: $11.3K
Pairs tracked: 1

SOURCE: DEXSCREENER · PRIMARY POOL PUMPSWAP · UPDATED 14 NOV 2026 22:35 UTC · REFRESHES EVERY 60S. 24H VOLUME SUMS ALL PAIRS.

BUY $CYBER DEXSCREENER

Token dossier● CONTRACT PUBLISHED

Token name: Cyber Pandemic
Ticker: $CYBER
Blockchain: Solana
Total supply: TBA
Contract address (CA): Gt1G6V5YEb9GyZzjq3wwxzDGU56BQwiK2eZP9dgFpump

DexScreener chart Block explorer X / Twitter · TBA Telegram · TBA

Speculative digital asset. No profit or investment return is guaranteed. Market figures are third-party data and can change rapidly. Only use the contract address published on this page.

The nextpandemic isdigital.

Threat Levels

Infection Timeline

FAA Nationwide Ground Stop

North Korean FaceStealer Crypto Theft Campaign

Microsoft 365 / Exchange Online Global Outage

Quantum Systems Cyberattack Grounds Bundeswehr Drones

Nitori Customer Data Breach

Check Point Gateway PHP2Shell Exploitation and ESXi Wiper Attacks

Binance exchange theft

Florida Student Financial Aid Website Breach

Arara Message Email Platform Breach (incl. City of Osaka)

UNM Health cyberattack and ambulance diversion

University Hospitals (Cleveland) Cyberattack

ConnectWise Cloud Backup Supply-Chain Compromise

IDCF Cloud Ransomware Attack

Denmark Central Population Register (CPR) data breach

Global Outbreak Map

Threat Analytics

Latest Outbreak Reports

Cursor confirms security breach led to malicious Claude Code extension

US disrupts North Korean campaign behind $400 million crypto theft

Is AI Making Us Worse at Cybersecurity?

Apple Reveals How Secure Exclaves Shield Camera and Microphone Data

No Signs of Hacking in FAA Ground Stop as FBI Reportedly Probes Software Update

FAA Ground Stop Issued Due to ‘Extraordinary Circumstances’

FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’

SCKit abuses ScreenConnect to deploy remote access and target technician sessions

City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents

Trezor confirms crypto-stealing implants in three wallets, releases fix

Check Point security advisory (AV26-1154) – Update 1

NYC to bar surveillance pricing as momentum for bans grows nationwide

German military drone operations disrupted by cyberattack

University of Texas at Arlington warns personal information stolen during cyberattack

German parliament passes law giving spy agencies hacking, sabotage powers

Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper

In Other News: New CISA Director Nominee, Connected Car Hacking, Baker Tilly Data Breach

How one AI agent exposed five critical enterprise security gaps

n8n security advisory (AV26-1160)

Apache security advisory (AV26-1159)

[Control systems] Johnson Controls security advisory (AV26-1158)

Microsoft Struggles to Restore Email and Other Services in a Global Outage

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CVE-2026-114713: UnrealIRCd Improper Neutralization of Delimiters Vulnerability

The outbreakhas begun.

The nextpandemic isdigital.

Threat Levels

Infection Timeline

FAA Nationwide Ground Stop

North Korean FaceStealer Crypto Theft Campaign

Microsoft 365 / Exchange Online Global Outage

Quantum Systems Cyberattack Grounds Bundeswehr Drones

Nitori Customer Data Breach

Check Point Gateway PHP2Shell Exploitation and ESXi Wiper Attacks

Binance exchange theft

Florida Student Financial Aid Website Breach

Arara Message Email Platform Breach (incl. City of Osaka)

UNM Health cyberattack and ambulance diversion

University Hospitals (Cleveland) Cyberattack

ConnectWise Cloud Backup Supply-Chain Compromise

IDCF Cloud Ransomware Attack

Denmark Central Population Register (CPR) data breach

Global Outbreak Map

Threat Analytics

Latest Outbreak Reports

Cursor confirms security breach led to malicious Claude Code extension

US disrupts North Korean campaign behind $400 million crypto theft

Is AI Making Us Worse at Cybersecurity?

Apple Reveals How Secure Exclaves Shield Camera and Microphone Data

No Signs of Hacking in FAA Ground Stop as FBI Reportedly Probes Software Update

FAA Ground Stop Issued Due to ‘Extraordinary Circumstances’

FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’

SCKit abuses ScreenConnect to deploy remote access and target technician sessions

City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents

Trezor confirms crypto-stealing implants in three wallets, releases fix

Check Point security advisory (AV26-1154) – Update 1

NYC to bar surveillance pricing as momentum for bans grows nationwide

German military drone operations disrupted by cyberattack

University of Texas at Arlington warns personal information stolen during cyberattack

German parliament passes law giving spy agencies hacking, sabotage powers

The next
pandemic is
digital.

The outbreak
has begun.

The next
pandemic is
digital.

The outbreak
has begun.