INCIDENT REPORT · CP-2024-009
Port of Seattle / Seattle-Tacoma Airport ransomware attack
L2 · GUARDEDCONFIRMED
A ransomware attack on 24 August 2024 caused IT outages at the Port of Seattle and Seattle-Tacoma International Airport over the Labor Day weekend. The Port refused to pay the ransom.
- Incident ID
- CP-2024-009
- Incident date
- 24 AUG 2024
- Detection date
- 24 AUG 2024
- Affected countries
- United States
- Plotted location
- SeaTac, United States (Affected infrastructure (Seattle-Tacoma International Airport))
- Threat classification
- Level 2 — GUARDED
- Classification rationale
- Regional ransomware disrupting airport and port IT services; flights continued to operate.
- Attack type
- Ransomware
- Nature
- Malicious activity
- Attack vector
- Not publicly documented
- Sectors
- Transportation, Government
- Critical infrastructure
- Yes
- Organizations affected
- Port of Seattle, Seattle-Tacoma International Airport
- Operational consequences
- Airport and port systems suffered outages. The Port later notified about 90,000 individuals that their personal data had been obtained.
- Estimated financial impact
- No reliably documented figure
- Attribution (as stated)
- Attributed by the Port of Seattle (13 September 2024) to the Rhysida ransomware group
SOURCE REFERENCES
- [1] Port of Seattle attack attributed to Rhysida ransomware groupSC Media · scworld.com
- [2] Port of Seattle ransomware breach exposes data on around 90,000 peopleTechRadar · techradar.com
RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.