The Port of Seattle, which owns and operates the Seattle-Tacoma airport, has confirmed that the ransomware attack that crippled operations at the airport in late August was the work of the Rhysida ransomware group. While the Port initially downplayed the severity of the incident, they have since acknowledged the full extent of the attack as recovery efforts continue.
The breach led to widespread service outages, causing major disruptions to check-ins, baggage handling, and Wi-Fi services. In some cases, airport staff had to resort to writing flight information on dry-erase boards and manually tagging pieces of luggage with pen and paper.
In a recent public statement, the Port of Seattle firmly rejected the ransom demands, citing that paying would compromise their core values and misuse taxpayer funds.
The Rhysida ransomware group, notorious for several high-profile cyberattacks, including a breach at a children’s hospital in Chicago earlier this year, is believed to have exfiltrated sensitive data from the Port’s systems. Officials are bracing for a potential data leak in retaliation for the Port’s refusal to meet the gang’s financial demands, keeping both the public and stakeholders on high alert.
Why It Matters: The Port of Seattle’s refusal to pay the Rhysida gang is a bold stance, but it also raises the stakes, as it may trigger retaliatory leaks. As they work to fully restore systems, the Port is also preparing for the possibility of a data breach. This incident is yet another glaring reminder of the fragility of critical infrastructure in the face of cyberattacks and the tough choices leaders are forced to make in such crises.
- Attack Overview: On August 24, 2024, the Rhysida ransomware group launched a cyberattack on the Port of Seattle, severely disrupting operations at Seattle-Tacoma International Airport (SEA). The attack took down multiple systems, including check-in kiosks, baggage services, flight information displays, and public Wi-Fi.
- Refusal to Pay Ransom: The Port of Seattle has publicly refused to meet the ransom demands, citing the importance of not succumbing to criminal extortion. Despite this, they remain vigilant, continuously monitoring systems for new activity.
- Data Breach Concerns: While the Port has not disclosed the exact nature of the compromised data, they confirmed that some information was exfiltrated. Investigations are ongoing to assess whether employee or passenger personal data has been accessed.
- Operational Impact and Recovery: The attack led to airport workers resorting to manual processes, causing delays and frustration among passengers. Most systems were restored within a week, but some, like the airport’s website and internal portals, remain offline as recovery efforts continue.
Port of Seattle Refuses to Pay Rhysida Ransom, Warns of Data Leak – The Record
