Port of Seattle, the USA authorities company overseeing Seattle’s seaport and airport, confirmed on Friday that the Rhysida ransomware operation was behind a cyberattack impacting its programs during the last three weeks.
The company revealed on August 24 that the assault pressured it to isolate a few of its crucial programs to include the influence. The ensuing IT outage disrupted reservation check-in programs and delayed flights at Seattle-Tacoma Worldwide Airport.
In the present day, three weeks after the preliminary disclosure, the Port formally confirmed that the August breach was a ransomware assault coordinated by Rhysida ransomware associates.
“This incident was a “ransomware” assault by the felony group often called Rhysida. There was no new unauthorized exercise on Port programs since that day. It stays secure to journey from Seattle-Tacoma Worldwide Airport and use the Port of Seattle’s maritime amenities,” it mentioned in a press launch.
“Our investigation has decided that the unauthorized actor was in a position to acquire entry to sure components of our pc programs and was in a position to encrypt entry to some knowledge.”
The Port’s resolution to take programs offline and the ransomware gang encrypting people who weren’t remoted in time brought on outages impacting a number of providers and programs, together with baggage, check-in kiosks, ticketing, Wi-Fi, passenger show boards, the Port of Seattle web site, the flySEA app, and reserved parking.
Whereas the Port has already introduced most affected programs again on-line throughout the week, it is nonetheless engaged on restoring different key providers, just like the Port of Seattle web site, SEA Customer Cross, TSA wait instances, and flySEA app entry (except downloaded earlier than the August ransomware assault).
The Port has additionally determined to not give into the ransomware gang’s calls for to pay for a decryptor although the attackers would seemingly publish knowledge stolen in mid-to-late August on their darkish net leak website.
“The Port of Seattle has no intent of paying the perpetrators behind the cyberattack on our community,” mentioned Steve Metruck, Govt Director of the Port of Seattle. “Paying the felony group wouldn’t mirror Port values or our pledge to be a great steward of taxpayer {dollars}.”
Rhysida is a comparatively new ransomware-as-a-service (RaaS) operation that surfaced in Could 2023 and rapidly gained notoriety after breaching the British Library and the Chilean Military (Ejército de Chile).
The U.S. Division of Well being and Human Companies (HHS) linked Rhysida to assaults in opposition to healthcare organizations. On the identical time, CISA and the FBI warned that this cybercrime gang was additionally behind many opportunistic assaults focusing on victims throughout a variety of different trade sectors.
As an illustration, in November, Rhysida breached Sony subsidiary Insomniac Video games and leaked 1,67 TB of paperwork on the darkish net after the sport studio refused to pay a $2 million ransom.
Its associates have additionally breached the Metropolis of Columbus, Ohio, MarineMax (the world’s largest leisure boat and yacht retailer), and the Singing River Well being System. The latter warned nearly 900,000 folks that their knowledge had been stolen in an August 2023 Rhysida ransomware assault.