Port of Seattle Data Breach Details
The cyberattack, identified on August 24, 2024, caused system outages at the Port, prompting an immediate investigation. Upon detecting the cyberattack, the Port of Seattle immediately took action. Critical systems were isolated, and certain systems were taken offline to prevent further damage.
The Port also brought in cybersecurity experts to assist with the investigation and to assess the full scope of the breach. The Port has since completed their investigation and has begun mailing notification letters to those whose data was affected. Approximately 90,000 individuals will receive notifications, with around 71,000 of them residing in Washington state.
Initial signs pointed to a ransomware attack, later confirmed to be carried out by the notorious Rhysida ransomware group. Rhysida, known for targeting large organizations, demanded a ransom in exchange for not releasing stolen data. The Port of Seattle, however, refused to comply with the ransom demands, which led the group to threaten posting the stolen data on the dark web.
Despite the breach, the Port was able to ensure that crucial systems, including those related to air travel and maritime operations, were not affected. Importantly, the systems of major airline and cruise partners, as well as federal partners such as the Transportation Security Administration (TSA) and U.S. Customs and Border Protection, were not impacted.
The Port is offering free credit monitoring to those affected by the breach. This service will help you detect any unauthorized activity or potential identity theft linked to the stolen information.
What Information Was Exposed?
The data accessed and stolen in the attack was primarily from outdated systems that stored personal information related to employees, contractors, and parking data. This included:
- Names
- Dates of birth
- Social Security numbers (or the last four digits)
- Driver’s license or government identification card numbers
- Some medical information
