United States Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, United States
Background readingHacktivismIncident response
No public level found
No published national cyber threat level found for The United States, checked 7 Nov 2026. The United States publishes no national cyber threat level; CISA signals threats through joint advisories with the FBI and partners, emergency directives and its exploited-vulnerabilities catalog.
Source: CISA News
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
 Malaysia | Medium | 19 | 35 | 7 | 7 Nov 2026 |
 Singapore | None published | 12 | 24 | 3 | 7 Nov 2026 |
 Indonesia | None published | 6 | 32 | 0 | 5 Nov 2026 |
 Thailand | None published | 9 | 33 | 0 | 3 Nov 2026 |
 Philippines | None published | 9 | 35 | 4 | 7 Nov 2026 |
 Vietnam | None published | 5 | 34 | 0 | 5 Nov 2026 |
 Israel | None published | 4 | 2 | 0 | 7 Nov 2026 |
 Iran | None published | 4 | 0 | 0 | 13 Jun 2026 |
 United Arab Emirates | None published | 4 | 4 | 1 | 7 Oct 2026 |
 Saudi Arabia | None published | 2 | 5 | 0 | 12 Oct 2026 |
 Egypt | None published | 1 | 4 | 1 | 29 Oct 2026 |
 South Africa | None published | 8 | 0 | 1 | 26 Oct 2026 |
 Nigeria | None published | 2 | 3 | 0 | 8 Aug 2026 |
 Kenya | None published | 1 | 6 | 0 | 25 Jul 2026 |
 India | None published | 9 | 2 | 1 | 28 Oct 2026 |
 Pakistan | None published | 3 | 3 | 0 | 22 Jul 2026 |
 Bangladesh | None published | 1 | 5 | 0 | 23 Oct 2026 |
 Sri Lanka | None published | 4 | 3 | 1 | 1 Jul 2026 |
 Cambodia | None published | 0 | 3 | 0 | 10 Jun 2026 |
 Myanmar | None published | 1 | 5 | 0 | 25 Oct 2026 |
 Brunei | None published | 0 | 0 | 0 | |
 Poland | BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 |
 Ukraine | None published | 7 | 0 | 1 | 4 Nov 2026 |
 Russia | None published | 7 | 0 | 1 | 1 Nov 2026 |
 Czechia | None published | 3 | 0 | 1 | 22 Oct 2026 |
 Romania | None published | 2 | 0 | 0 | 14 Jul 2026 |
 Estonia | None published | 5 | 0 | 3 | 4 Nov 2026 |
 Turkey | None published | 3 | 0 | 1 | 16 Sep 2026 |
 United Kingdom | None published | 5 | 1 | 3 | 2 Nov 2026 |
 Germany | None published | 4 | 0 | 1 | 2 Nov 2026 |
 France | None published | 7 | 0 | 2 | 4 Nov 2026 |
 Netherlands | None published | 5 | 1 | 1 | 2 Nov 2026 |
 Italy | None published | 5 | 0 | 0 | 7 Nov 2026 |
 Spain | None published | 3 | 0 | 0 | 5 Feb 2026 |
 Ireland | None published | 3 | 4 | 0 | 2 Nov 2026 |
 Sweden | None published | 5 | 3 | 2 | 2 Nov 2026 |
| United States | None published | 6 | 0 | 2 | 28 Aug 2026 |
 Canada | None published | 5 | 0 | 1 | 21 Aug 2026 |
 Mexico | None published | 2 | 4 | 1 | 21 Aug 2026 |
 Brazil | None published | 2 | 2 | 0 | 2 Nov 2026 |
 Argentina | None published | 1 | 2 | 0 | 4 Aug 2026 |
 Chile | None published | 1 | 2 | 0 | 2 Nov 2026 |
 Colombia | None published | 1 | 2 | 0 | 4 Nov 2026 |
 Japan | None published | 9 | 0 | 5 | 4 Nov 2026 |
 South Korea | Caution | 6 | 0 | 2 | 29 Oct 2026 |
 China | None published | 0 | 3 | 0 | 7 Aug 2026 |
 Taiwan | None published | 9 | 0 | 2 | 3 Nov 2026 |
 Hong Kong | None published | 3 | 0 | 3 | 30 Oct 2026 |
 Australia | None published | 5 | 0 | 1 | 2 Nov 2026 |
 New Zealand | None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
| Measure | Value | Period | Source |
|---|---|---|---|
| Reported cybercrime losses (FBI IC3) | $20.877 billion | 2025 | Help Net Security on the FBI IC3 2025 report |
| Complaints received by FBI IC3 | 1,008,597 | 2025 | FBI IC3 2025 Internet Crime Report |
| Cyber-enabled fraud losses (FBI IC3) | $17.7 billion | 2025 | Help Net Security on the FBI IC3 2025 report |
| Ransomware complaints to FBI IC3 | 3,611 | 2025 | The Record |
Who is targeting it
| Group | Kind | What it did | Sources | Reports |
|---|---|---|---|---|
| ShinyHunters | Extortion | Claimed data theft from Wynn Resorts, DentaQuest and McKesson in 2026. | HIPAA Journal · The Record | Profile |
| SafePay | Ransomware | Subject of an October 2026 CISA and FBI advisory linking it to about 600 victims across critical infrastructure. | CISA |
Laws and rules this year
Full stories
- DentaQuest breach hits at least 15 million people United States · 20 May 2026
Official statements
- 26 Oct 2026CISA released its CISA 2030 strategy, built on cyber defense, hardening infrastructure and national resilience. CISA
- 21 Oct 2026CISA, FBI and partners warned that SafePay ransomware actors were targeting several critical infrastructure sectors. CISA
- 8 Oct 2026CISA, FBI, NSA and partners warned that a China-based cybersecurity company was enabling attacks on critical infrastructure. CISA
- 6 Apr 2026The FBI's IC3 released its 2025 report, with over one million complaints for the first time. The Record
Incidents
6 of 6 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
 ✅ ConfirmedMcKessonVia a vendor | 28 Aug 2026 | Health | Supply chain | Confirmed. McKesson disclosed in SEC filings that attackers used a third-party application to take data on oncology and surgical customers. Claimed. ShinyHunters claimed the attack and threatened to leak the data. | The Record✓ 7 Nov | |
 ✅ ConfirmedNorth Carolina Ports Authority | 4 Aug 2026 | Transport | Intrusion | None | Confirmed. A ports spokesperson said the IT system was hacked by an outside actor and the Wilmington, Morehead City and Charlotte sites moved to manual processing. | The Record✓ 7 Nov |
 ✅ ConfirmedAmgenVia a vendor | 3 Aug 2026 | Health | Data leak | None | Confirmed. Amgen told the SEC that attackers took proprietary information and patient health data from cloud environments run by outside providers. | The Record✓ 7 Nov |
 ✅ ConfirmedDentaQuestFull story | 20 May 2026 | Health | Data leak | Confirmed. DentaQuest found unauthorized network access between 17 and 20 May 2026 and is notifying at least 15 million people. Claimed. ShinyHunters claimed 234 GB of stolen data and leaked it after talks failed. | HIPAA Journal✓ 7 Nov | |
 ✅ ConfirmedLexisNexis Legal & Professional | 3 Mar 2026 | Other | Intrusion | Confirmed. LexisNexis said an unauthorized party accessed a limited number of servers holding mostly legacy customer data. Claimed. FulcrumSec leaked about 2 GB of files and claimed about 400,000 cloud user profiles, including .gov addresses. | BleepingComputer✓ 7 Nov | |
 ✅ ConfirmedWynn Resorts | 24 Feb 2026 | Other | Data leak | Confirmed. Wynn said an unauthorized third party acquired certain employee data, after ShinyHunters listed the company on its leak site. Claimed. ShinyHunters claimed over 800,000 records including Social Security numbers. | BleepingComputer✓ 7 Nov |
FAQ
Does United States have a national cyber threat level?
No published national cyber threat level was found for The United States (checked 7 Nov 2026). The United States publishes no national cyber threat level; CISA signals threats through joint advisories with the FBI and partners, emergency directives and its exploited-vulnerabilities catalog.
Which organisations in United States confirmed cyber incidents recently?
6 incidents confirmed since January 2026: McKesson, North Carolina Ports Authority, Amgen, DentaQuest, LexisNexis Legal & Professional and Wynn Resorts.
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.