HackingGovernmentGovernmentStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountHealth (basic)PIICriticalActive

Pierce County Library System

bd_13778595ed20da50 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Apr 14, 2025

Filed

Jun 20, 2025

To disclose

10 weeks

Affected

336,826state residents only

Confidence

70%

Full breach record for Pierce County Library System →3 incidents on file

Supplemental notice from Pierce County Library System (WA) regarding unauthorized access to systems between April 15-21, 2025. Incident discovered April 14, 2025. Affects 336,826 Washington residents. Data exposed includes names, SSNs, financial/medical info, driver's licenses, and DOBs. PCLS notified law enforcement, offered 1-year credit monitoring via IDX, and is implementing additional employee safeguards.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d10 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

Apr 15, 2025

Begins

Jun 20, 2025

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed336,826 affectedView incident

Name: Pierce County Library System
norm: pierce county library system
Domain: piercecountylibrary.org

Name: Pierce County Library System
norm: pierce county library system
Domain: piercecountylibrary.org
Industry: Governmentllm

Discovered: Apr 14, 2025
Breach occurred: Apr 15, 2025 – Apr 21, 2025
Materiality determined: —
Notification sent: Dec 9, 2025
Affected individuals: 336,826state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PII
Data elements: NameDate of birth
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified Washington State Office of the Attorney General
Initial access: valid_credentials

During the incident: Initiated an investigation into the nature and scope of the event
Took steps to secure systems
Undertook a thorough review of the impacted systems
Notified law enforcement regarding the event
Provided access to credit monitoring services for one year through IDX
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Working to implement additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(67 days from discovery to filing)
Compliance flags: Leak >30dWA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33657.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 20, 2025
Raw hash: b9af469e0e57b02cc970c8c3a834ac8f6b6f066f5dd572bc0d22c10aa3de078f

Reporting entityPierce County Library System

Victim entityPierce County Library System

Incidentdiscovered Apr 14, 2025

Stated responseInitiated an investigation into the nature and scope of the event

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com