Port of Seattle blames the Rhysida ransomware group for August cyber attack

Port of Seattle said that the infamous Rhysida ransomware group was behind a significant cyber attack that affected its systems, including those at the Seattle-Tacoma International Airport.

 

On August 24, the Port of Seattle, which operates the city’s airport and seaport, said it experienced a data security incident. While the cyber attack was aimed primarily at the Port of Seattle’s systems, it had a massive effect on the Seattle-Tacoma International Airport, causing widespread delays and a temporary halt to certain systems.

 

In a separate update, Port authorities said, “Virtually all airlines are back to full service for ticketing and baggage management. Few flight delays or disruptions are occurring beyond a typical busy holiday volume period. That continues to be the main priority to get passengers to and from their travels safely. TSA wait times are minimal while dining and retail locations are operating normally.”

 

In a recent press release, the Port of Seattle said that its investigation has revealed that the Rhysida ransomware group was responsible for infiltrating its internal network.

 

“Our investigation has determined that the unauthorised actor was able to gain access to certain parts of our computer systems and was able to encrypt access to some data. 

 

“We took steps to block further activities including disconnecting our systems from the internet, but unfortunately, the encryption and our response actions hindered some port services including baggage, check-in kiosks, ticketing, Wi-Fi, passenger display boards, the Port of Seattle website, the flySEA app, and reserved parking,” the port said.

 

Port authorities added that most of the affected systems are back online and current operational status is available on its temporary website.

 

“The Port has refused to pay the ransom demanded, and as a result, the actor may respond by posting data they claim to have stolen on their dark web site,” Port of Seattle added.

 

Port authorities are still in the process of determining the nature and scope of the exfiltrated data and will share details on the same as and when available.