Just how many cyberattacks are there in the Midwest? We compiled a list.

Search, filter, and sort attacks known near your location

In the last five years, starting March 31, 2021 through March 31, 2026, there were 43 confirmed cyberattacks in the Midwest. One attack was attempted and one other was suspected. If that seems low, it’s because it is. And in the time since we compiled this list and this publication, Iranian-linked hackers have claimed control of the St. Joseph County, Indiana (home of South Bend and Notre Dame University) infrastructure, records, and systems.

How we compiled data on cyberattacks

Looking at publicly-available data we compiled a list by looking at public press releases, news reports, public government reports, and, in some cases, public notices from the attackers.

• We only sought information on large-scale industries, healthcare facilities, schools, and commercial operations.
• Small businesses under 50 people and individuals are not included.
• We only looked at information available in 12 Midwest states (IA, IL, IN, KS, MI, MN, MO, ND, NE, OH, SD, WI)

The numbers of attacks are certainly far higher than reported

What’s not included in this cyberattack data

Data on cyberattacks is often not made public by private institutions, and, sometimes public ones. Private institutions have more incentive to keep details quiet. Public institutions, or private institutions that serve large numbers of people (like private hospitals or universities) have to weigh the risk of not disclosing that vital records or information may have been compromised.

Keeping quiet can protect an entity’s short-term financial interests, and is sometimes recommended by law enforcement as a means of “not giving attention” to attackers. A 2025 attack on Grand Forks, North Dakota schools provided limited details at the request of law enforcement. But that attack reportedly involved wire fraud and an ACH charge, which could potentially involve internal staff.

Still, attackers rarely want attention, and if they do it’s easy to get it. Instead, attackers are almost always motivated by money, usually in untraceable Bitcoin (virtual currency). This is why most attackers do leave systems alone or restore data if a ransom is paid. Think of it as a sort of pirate’s code: it harms other pirates if victims know or assume that whether they pay or not is irrelevant, so why bother paying if the damage is inevitable?

As one example, also from the North Dakota, a school district there mistakenly paid a contractor $1.8 million while the school was undergoing a large renovation project. The district said it was the victim of a “sophisticated phishing email containing false payment instructions that appeared to come from a trusted vendor.”

The actual number of cyberattacks is almost unknowable

Cyberattacks, like domestic violence and many other “personal” crimes are tragically difficult to report, often because of shame, fear, embarrassment, or the fear of future harassment.

It is also almost unknowable how many cyberattacks are in the works or were even accidentally prevented.

What is known is most attacks start with a phishing or spear-phishing campaign against small groups of internal employees.

1. One of those employees clicks a link, downloads an attachment, or somehow executes code that implants itself on a network or machine.
2. The malware may remain dormant for many months, or even years.
   1. It may be quietly recording information and sending it to some server elsewhere for review, like keystrokes or patterns for when a user logs in or logs off.
   2. The more time that passes, the more difficult it becomes to remember how it may have started. An employee is unlikely to remember a random email from six months ago that, since then, has done seemingly nothing.
3. The malware may activate either based on time, like a bomb, or remotely based on an attacker’s perception of detection risk. For instance, an attacker is less likely to begin a more robust cyberattack at noon on a Wednesday when the most amount of IT, security, and support staff are likely available.

It is also possible many attacks were thwarted by accident, where dormant malware sits on a machine that coincidentally gets replaced, or perhaps the hardware fails and is removed from the network.

Targeted hardware can include printers, phones, routers, and more

Much of the focus on cyberattacks is on computers, like Windows 10 or 11 PCs and Macs. But almost every device with Bluetooth, Wi-Fi, or a screen can be considered a computer. Certainly smart phones, but also smart hubs for lights, old routers that are rarely replaced or updated until they fail, printers, even VoIP phones can all be targets that enable access to a network.

Still, the weakest link in cybersecurity is almost always humans. It’s the phone call, text message, or email that contains a link or threat you don’t quite notice. AI tools are going to make this more challenging to spot as emails that were once written with poor English and grammar are now near-perfect. Or phone calls that can be emulated using AI that synthesizes a target’s voice from YouTube or other public videos.

Prepare for when, not if, an attack is possible in your facility or organization

The federal government rates cyberattacks on a scale commensurate with the overall damage and harm to life and property. A Level 5 Black emergency would result in a State of Emergency, whereas a Level 1 Green emergency poses low risk. The chart was introduced in 2016, but can be used internally at your facility.

Like knowing what to do in case of a fire or other emergency, it’s time to elevate your cyber preparedness at all levels of attack potential. VPC provides realistic training scenarios and tabletop exercises that test your team’s ability to respond to threats as they happen. This includes

• How to maintain operations
• What to do system-wide as teams observe and prepare for possible attacks
• Serve customers or patients
• Provide timely updates and notifications to the press
• How to interact with other agencies and partners, and inform stakeholders.