MalwareGovernmentGovernmentRansomwareCapture Stored DataData ExfiltratedData EncryptedCustomer Data InvolvedAuthenticationCredentialsIdentity (basic)Government IDMediumActive

Whatcom County Library System

bd_5fa4c2f14dae7487 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 26, 2022

Filed

Jul 28, 2022

To disclose

5 weeks

Affected

630state residents only

Linked

2 records

Confidence

69%

Full breach record for Whatcom County Library System →

Whatcom County Library System (WCLS) disclosed a ransomware cyberattack discovered on June 26, 2022. An unknown actor downloaded files containing Washington residents' names, DOBs, driver's license/ID numbers, SSNs, and library account barcodes/PINs. Approximately 630 Washington residents were notified starting July 11, 2022. WCLS engaged law enforcement, implemented technical security measures, and offered Equifax credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d5 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 5 weeks / 32 days

Jun 26, 2022

Begins

Jun 26, 2022

Discovered

Jul 28, 2022

Filed

This filing is one of 2 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteunsafebd_edf5c64270efe4582022-12-21 · +146dVerified by operator

Name: Whatcom County Library System
norm: whatcom county library system
Domain: wcls.org

Name: Whatcom County Library System
norm: whatcom county library system
Domain: wcls.org
Industry: Governmentllm

Discovered: Jun 26, 2022
Breach occurred: Jun 26, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 11, 2022
Affected individuals: 630state-resident count only
Data types: Identity (basic)Government IDCredentials
Data elements: NameSocial Security numberDriver's licence numberDate of birthUsername + password
WA-stated cause: Cyberattack
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the State Auditor’s OfficeNotified federal law enforcement

During the incident: Began an investigation to determine the nature and scope of the event
Notified the State Auditor’s Office and federal law enforcement of the event
Providing individuals with guidance on how to better protect against identity theft and fraud
Offering you complimentary access to monitoring services through Equifax
Automatically updated the PIN for your library account
Changes made: Implementing additional technical security measures designed to mitigate reoccurrence of this type of event
Reviewing and enhancing existing policies and procedures to reduce the likelihood of a similar future event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(32 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA13062.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 28, 2022
Raw hash: b323b6cb19746685bef5889aff78726383a87ca0649cb598fd207500e2900692

Linked disclosures

Ransomware claims (1)

Reporting entityWhatcom County Library System

Victim entityWhatcom County Library System

Incidentdiscovered Jun 26, 2022

Stated responseBegan an investigation to determine the nature and scope of the event

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com