An April 2025 ransomware incident at Pierce County Library System disrupted its catalog, self-checkout and other network services while branches remained open. Systems were restored by early June; library notices confirmed data theft, and INC Ransom’s responsibility remains an attributed claim.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Unauthorized access to systems, accounts, networks, or data.
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
A service, system, platform, or operational capability remained available only in part or with significant limitations.
Internal or external network connectivity was unavailable or materially impaired.
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
A specific application or software platform became unavailable or unusable.
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
Services continued but with longer processing, response, delivery, or completion times.
The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The actor published or shared a sample of allegedly stolen victim data to substantiate the extortion claim.
Pierce County Library System’s April 2025 ransomware incident disrupted network-dependent library services while physical branches continued operating. We reported that staff disconnected systems after suspicious activity was detected April 21. The library’s own statement confirmed unauthorized access and removal of library data. DysruptionHub assesses the cyberattack with high confidence; a named spokeswoman’s description of a ransomware event also supports high ransomware confidence.
The initial public outage report appeared April 28 and described technical issues without identifying their cause. By May 12, the library had acknowledged a cybersecurity event and data theft, according to The News Tribune’s reporting. Subsequent notices identified an April 15–21 unauthorized-access window. That access window is distinct from the April 21 operational shutdown.
Unavailable services included the catalog, physical self-checkout, book-club kits and some online resources. Staff could not check returned materials back into the system, and patrons were asked to retain borrowed items. Gig Harbor Now reported continuing restrictions and no recovery estimate May 8. Branches, meeting rooms, physical borrowing and scheduled events remained available; public computers and printers had limited availability.
The May 14 board minutes recorded system availability at 67%, following a low of 30%. A June 2 director memo in the same packet stated that all library systems had been restored. June 11 minutes confirmed services were online and backlogged records and materials had been processed. The operational incident is resolved, although these records do not identify the exact final restoration day.
Data theft is confirmed independently of the ransomware claim. The library’s patron notice says files were copied and taken and identifies names and dates of birth. A Dec. 9 supplemental filing describes additional employee and family information, potentially including government identifiers, financial and payment-card information, medical information and health insurance information, varying by person. It reports 328,342 Washington residents notified after address checks revised the earlier estimate. That jurisdiction-specific count is not a nationwide total, and the supplemental letters expressly concern the same incident.
An INC Ransom listing matches the library’s former domain. Comparitech reported that the group alleged 1.94 TB of theft and published purported document samples. These support an attributed INC claim, but do not establish the claimed volume or the identity of the intruders with the same confidence as the library’s confirmed findings. The record does not establish that every system was encrypted or that every listed information category affected every individual.
The reviewed evidence does not establish the initial access route, exploited vulnerability, encryption scope, ransom amount or payment outcome. Data review and notifications continued after service restoration; those activities do not establish an ongoing operational outage. A settlement administrator’s website describes a proposed resolution of employee-related litigation, but the reviewed material does not establish final court approval.
INC Ransom listed the library’s exact former domain. Independent reporting described the group’s 1.94 TB allegation and purported document samples. The library confirmed unauthorized access and data theft but did not independently establish INC’s responsibility or the claimed volume. Lead discovery is not an original publication or attack date.
Clover Creek anchors the library district’s administrative center. The library uses a Tacoma mailing address; this site relationship does not establish a separate building-specific outage.
The library district’s service territory provides geographic context for the affected public services. Branches remained open, and the relationship does not assert uniform disruption to every service or community.
We reported a multiweek network shutdown affecting the library catalog, self-checkout and other services after suspicious activity was detected April 21.
The library acknowledged unavailable catalog and online resources, while classes, events and physical borrowing continued.
The communications director described continued service restrictions, inability to check materials back in and no restoration estimate.
Named library spokeswoman Somer Hanson confirmed unauthorized access and data removal, called the event ransomware and described continued catalog and self-checkout restrictions.
May 14 minutes described partial service availability; a June 2 director memo stated that all library systems had been restored.
Comparitech reported that INC claimed the library breach, alleged 1.94 TB of theft and posted purported document samples.
June 11 meeting minutes confirmed services were back online and backlogged records and materials had been processed.
The supplemental filing reported additional employee and family data findings and revised the cumulative Washington notification count to 328,342.
The administrator described a proposed settlement involving employees, family members and contractors, with liability denied by the library.
The accessible MCP lead identifies INC Ransom’s listing of the library’s exact former domain, discovered May 22, 2025.
The library confirmed April 15–21 unauthorized access, files copied and taken, and names and dates of birth in affected patron files.
The library described precautionary shutdown after April 21 suspicious activity, confirmation of unauthorized access by May 12 and removal of library data.
Signed-in members can report an error, update, or missing source.
