Short answer: the United States is not facing a single, coordinated national cyber attack, but cyber incidents are happening every day. Federal agencies are tracking active threats against hospitals, local governments, schools, and industrial systems. The question surged on Friday, November 13, when a nationwide flight stoppage left thousands of travelers stranded.
Here is what is confirmed, what is not, and what you can do about it.
Is the US Under a Cyber Attack Today?
Officials say there is no sign of a nationwide cyber attack behind the biggest disruption of the week. Homeland Security Secretary Markwayne Mullin said during a Friday night White House briefing that the nationwide ground stop was “just a telecommunications outage.” Multiple officials told NBC News there was no initial indication of malicious activity, though the exact cause was still being determined. You can follow the live updates on the FAA outage for the latest.
That is only part of the picture. Ransomware, data theft, and attempts to compromise critical systems continue across the country. They are persistent, and so far they are not a single coordinated assault.
What Happened With the FAA Ground Stop?
On November 13, a communications outage triggered a nationwide ground stop. Thousands of flights were canceled or delayed before the FAA lifted the stop. Officials said the public was never in danger and that the stop was precautionary.
Three senior officials also said nothing indicated a link between the FAA problem and a separate widespread Microsoft outage. The investigation into the root cause is still open, so the cause is not final. Treat any claim that it was an attack as unconfirmed until federal officials say otherwise.
Cyber Incidents Hitting US Organizations This Month
Independent trackers that follow public reports have logged a steady run of incidents in November 2026. These are reports, not official counts, and details can change as investigations continue.
- Local governments: Ransomware or network disruptions have hit county and municipal offices, in some cases closing tax, assessment, and court offices. One county reported a week-long restoration effort after its servers were shut down.
- Healthcare: A California hospital reported disrupted phone and computer systems, though the cause was not confirmed. A medical school was hit by ransomware, and a laboratory operator reported a breach involving patient records.
- Schools: Several school districts and a high school have reported ransomware or fraud incidents.
- Government-adjacent targets: Reports include an attack on a federal campaign finance regulator and a leak site posting data tied to Homeland Security employees. These claims are still developing.
Criminal ransomware groups also routinely post victim names on leak sites. Those listings are claims, not verified breaches.
Why Federal Agencies Are Warning About Refrigeration Systems
The most notable official warning this month is about industrial refrigeration and cold chain monitoring systems. On November 5, CISA, the FBI, HHS, USDA, and the Department of Transportation said they were aware of malicious cyber activity targeting these systems globally.
The advisory followed incidents in which hackers tampered with temperature controls. Agencies urged operators in healthcare, food and agriculture, chemicals, and transportation to harden these systems. These networks matter for medicines, vaccines, blood products, and groceries. At least one other country reported a breach of cold-storage controls earlier this month. U.S. authorities warned operators to watch for similar attacks.
How Big Is the Cyber Threat to Americans?
The FBI’s Internet Crime Complaint Center reported record losses for 2025. Americans lost about $20.9 billion to cybercrime, from more than 1 million complaints, the first time the center has reached that number.
Key figures from the report:
- Crypto-related losses: More than $11.3 billion, with crypto investment scams alone near $7.2 billion.
- Adults over 60: About $7.7 billion in losses, a 37% jump from the prior year.
- AI-related fraud: More than 22,000 complaints and roughly $893 million in losses, the first year the FBI broke out AI as its own category.
The FBI also announced actions this week against a North Korea-linked scheme that stole more than $400 million in cryptocurrency through deepfake video calls. Cloud infrastructure used in the campaign was seized, according to reports of the announcement.
What About Election Security After the Midterms?
The November 3 midterm elections are over, and CISA had published an election infrastructure security plan beforehand. One Connecticut town isolated its municipal network after a possible intrusion and said its voting system remained secure. Beyond that, public reporting has not pointed to a confirmed attack that changed any election outcome. Official election results come from state and local election offices, not from cybersecurity trackers.
Which Software Flaws Are Being Actively Exploited?
CISA keeps a public list of software flaws that attackers are known to be using. At least 13 vulnerabilities were added across four updates between November 6 and November 13, affecting products from vendors including Microsoft, Cisco, Google, IBM, and Barracuda. Federal agencies get firm deadlines to patch these, and the list is useful for businesses too. Check the Known Exploited Vulnerabilities catalog if you manage a company’s systems.
What Should You Do to Stay Safe?
You can’t stop a hospital or county from being hit, but you can reduce your own exposure.
- Update your devices. Install updates for your phone, computer, browser, and router promptly.
- Turn on multifactor authentication. Prefer an authenticator app or security key over text codes where possible.
- Slow down on urgent requests. Pressure to act immediately is the most common scam tactic. That includes video or voice calls from someone who “looks” or “sounds” like a boss or relative, since AI deepfakes are increasingly used.
- Watch for breach notices. If a company tells you your data was exposed, change that password and any reused ones, and consider a credit freeze.
- Report fraud quickly. File a complaint with the FBI’s Internet Crime Complaint Center. Faster reports give investigators and banks a better chance of stopping losses.
What to Watch Next
- The FAA investigation. Officials have not yet named a final cause for the outage. A formal explanation is the key detail to watch.
- Cold chain and healthcare advisories. Watch for more guidance or confirmed incidents involving refrigeration and medical supply systems.
- New federal alerts. CISA posts new advisories almost daily at its cybersecurity alerts page. CISA also announced an enhanced cyber incident reporting form this week.
- Breach notifications. Companies often confirm the scope of attacks days or weeks later, so numbers can rise.
Do you feel safer online, or has this week changed how you think about cyber threats? Share your thoughts in the comments and check back for updates as officials confirm more details.