Heroku runs on AWS, so it would be an AWS attack of some sort. But AWS in general seems to be up from what I can tell, so I'm feeling like it's not a cyberattack, and just a Heroku specific problem.

Collateral damage (but probably DNS lol)

Maybe not heroku per se but something hosted on heroku?