ICS Ransomware and Cyber-Physical Attack Incident Dataset, 2016–2025 (N=127)

Incident-level dataset of 127 documented ransomware and cyber-physical attacks on US critical infrastructure ICS (water, electrical, transportation sectors), 2016–2025. Reconstructed deterministically from published summary statistics in the associated systematic review manuscript. Contains 27 variables per incident including sector, network architecture, attack vector, breach outcome, defence layers, MTTD, financial impact, and attack surface score. Full variable definitions in the accompanying codebook. Reproducible analysis notebook included. Source documents for each incident are listed in the manuscript's Supplementary Table S1.