Method

How an incident gets a pin

The map is a curated board of public cyber incidents from 1 January 2025 through 4 November 2026. It is not a list of every attack.

What is included

An incident is on the board when it has a named victim, a date in that window, and a public source: a company or government notice, or a news report that quotes one. The types are ransomware, a data breach, or a disruption of a company, a state body, or infrastructure.

Campaigns with no named victim, vulnerability notices that are not an incident, and claims that only appear on a criminal leak site are left off.

Where the pin sits

The pin is the country where the harm was reported, not the country blamed for the attack. If the source names a city, the pin uses it. If it names only the organization, the pin uses that organization’s main public location. A country-wide incident with no city uses a point in the country. Nearby pins are offset so they can be clicked.

What counts as money

The header adds stolen funds, ransoms the victim says it paid, and damage figures a source states in dollars. A demand is not stolen money. A range is not a single number. A figure published only in another currency stays in the note.

Bybit’s own timeline states a $1.46 billion cold-wallet theft. That is stolen, and it is in the total.
Reuters reported Marks & Spencer’s estimate of about £300 million ($403 million) in operating profit, and the Cyber Monitoring Centre’s £1.9 billion Jaguar Land Rover model as $2.55 billion. Those are reported damages, not cash taken from a wallet.
Coinbase estimated $180 million to $400 million and refused a $20 million demand. The range and the demand stay off the total.
The Co-op’s £206 million of lost sales has no dollar figure in the source, so it stays off the total.
Upbit’s operator and a later wire report published two different dollar conversions. Neither is added.
The BBC’s estimate of tens of millions of euros in spoiled food at French supermarkets in October 2026 is not a dollar figure, so those refrigeration attacks stay off the total.

Where a source gives no number, the pin says so. An empty loss is not treated as zero dollars of damage.

What the board is not

Most attacks are never disclosed, and many disclosures have no dollar figure. Absence from the map is not a claim that a country or a company was not hit. The file behind the map is data/incidents.json. Each record has the source URL used for the description and the figure.