MalwareGovernmentGovernmentRansomwareCapture Stored DataData ExfiltratedTargetedAuthenticationEducationFinancial accountIdentity (basic)Government IDPHIPIIHealth (basic)HighContained

The Seattle Public Library

bd_5ef21f853005bb4b · schema v1 · pii pii-v1

Severity

High

Discovered

May 25, 2024

Filed

Dec 12, 2024

To disclose

29 weeks

Affected

26,965state residents only

Confidence

71%

Full breach record for The Seattle Public Library →

The Seattle Public Library experienced a ransomware attack on May 24-25, 2024. The unauthorized actor downloaded files containing personal information (PII) from the Library's network. The Library engaged forensic investigators, notified law enforcement, and implemented MFA and stronger password practices. 26,965 Washington residents were affected. Notices were sent on December 12, 2024.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d29 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 1 days

discovery → filing · 29 weeks / 201 days

May 24, 2024

Begins

May 25, 2024

Discovered

Dec 12, 2024

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed26,965 affectedView incident

Name: The Seattle Public Library
norm: the seattle public library

Name: The Seattle Public Library
norm: the seattle public library
Industry: Governmentllm

Discovered: May 25, 2024
Breach occurred: May 24, 2024 – May 25, 2024
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Dec 12, 2024
Affected individuals: 26,965state-resident count only
Data types: PIIIdentity (basic)
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthStudent ID numberPassport numberHealth insurance IDMedical informationUsername + password
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial

During the incident: Took immediate steps to stop the attack and successfully ejected the unauthorized actor from our digital environment
Engaged a digital forensic firm to investigate
Notified law enforcement
Working to add further protections to harden systems
Changes made: Deploying additional safeguards onto our systems, such as multifactor authentication and stronger password practices
Hiring for a new permanent position focused on cybersecurity
Actively reviewing our systems to enhance security monitoring and controls
Offering free 24-month membership to Experian IdentityWorks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(201 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31681.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 12, 2024
Raw hash: 386ac66ee7602595e108874641480fdea392effb102798d0ede993d6c2221f01

Reporting entityThe Seattle Public Library

Victim entityThe Seattle Public Library

Incidentdiscovered May 25, 2024

Stated responseTook immediate steps to stop the attack and successfully ejected the unauthorized actor from our digital environment

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com