The Port of Seattle says the Rhysida ransomware operation was behind an August 24 cyberattack and “it does appear that some Port data was obtained by the actor”

Sergiu Gatlan / BleepingComputer :

BleepingComputer 2024-09-16 Sergiu Gatlan

Context & Ripple Effects

This attribution adds a data-theft dimension to a sector already hit by ransomware: the Port of Nagoya's ransomware disruption required an operational restart, while DP World later reported stolen employee data after its own incident.

The Seattle case also fits the broader ransomware playbook seen when an attack on a shipping-management provider affected DNV's ShipManager customers and vessels. It matters because a port sits at the intersection of public infrastructure, logistics operations, and sensitive administrative data.

First-order effects

The Port of Seattle can now focus incident response on a named ransomware operation and determine what Port data may have been taken.
People and organizations whose information is held by the Port may face exposure risk while the scope and sensitivity of the acquired data are assessed.

Second-order effects

Other port operators and maritime technology providers have a fresh reason to test whether ransomware containment also prevents data exfiltration, not merely system encryption.
The incident reinforces scrutiny of third parties and shared systems in logistics, where a compromise can affect operational and administrative data at once.

Third-order effects

If attacks on ports and maritime suppliers continue, ransomware risk will increasingly be treated as a resilience issue for logistics infrastructure rather than solely an IT-security problem.
The pattern points toward attackers valuing data theft alongside disruption; the scale of that shift will depend on what investigations disclose about affected systems and data.

The trend: Ransomware is becoming a dual threat to logistics infrastructure, combining operational disruption with data-extortion pressure.

Discussion

@portofseattle @portofseattle on x
We are committed to these efforts and notifying potentially impacted stakeholders as appropriate. In particular, if we identify that the actor obtained employee or passenger personal information, we will carry out our responsibilities to inform them.
@airlineflyer Jason Rabinowitz on x
SeaTac confirms that it was hit with a ransomware attack on August 24 and refused to pay the ransom. Some of its computer systems were encrypted, with data accessed and dumped on the dark web.
@jgreigj Jon Greig on x
The Port of Seattle is refusing to pay Rhysida ransomware hackers and warned employees and passengers of the airport and seaport that data will likely be leaked https://therecord.media/...
@portofseattle @portofseattle on x
This incident was a “ransomware” attack by the criminal organization known as Rhysida. The efforts our team took to stop the attack appear to have been successful. There has been no new unauthorized activity on our systems since that day.
@portofseattle @portofseattle on x
While our response and recovery are still ongoing, we wanted to share updated information about what happened, what we have been doing, and how we are further strengthening our security. It remains safe to travel from @flySEA and use our maritime facilities.
@portofseattle @portofseattle on x
On Aug. 24, we identified system outages consistent with a cyberattack. It was a fast-moving situation, and our staff worked to quickly isolate critical systems. [image]
@portofseattle @portofseattle on x
Our investigation of what data the actor took is ongoing, but it does appear that some Port data was obtained by the actor in mid-to-late August. Assessment of the data taken is complex and takes time.

Chronicles