Analyst assessment
The Port of Seattle’s August 2024 ransomware attack interrupted airport and maritime services, while later records document a longer recovery for administrative and police systems. The Port identified outages on Aug. 24, isolated its network and publicly described a possible cyberattack that afternoon. Its dated updates later identified Rhysida and confirmed encryption. A subsequent one-year review described unauthorized laptop activity during July and August, but did not establish an exact initial-access date.
This was a disruption of interconnected business and public-facing services rather than a shutdown of aviation or maritime movement. Encryption and defensive isolation both contributed. Paper processing, alternate communications and staff redeployment sustained operations, while restoration of the airport’s visible systems concealed a more prolonged burden on back-office and police work.
Operational significance
Shared airport technology for baggage messaging, ticketing, check-in, passenger displays and Wi-Fi failed, prompting handwritten documents, manual baggage movement and in-person assistance. Most passenger systems returned within a week; all airline flight and baggage displays were operating by Sept. 11. In Senate testimony, aviation director Lance Lyttle said staff moved more than 7,000 bags manually. Major airline, cruise and federal partners’ own systems were unaffected, and the Port maintained safe travel and maritime operations.
Recovery extended beyond those passenger milestones. The police department’s annual report says dispatch was partly restored in September 2024, phones returned Feb. 11, 2025, and records management remained unavailable when that account was prepared. A maritime recovery audit documents delayed customer billing, interim payroll calculations and months of manual vessel records. It says payroll was normal by early 2025, but does not establish a common restoration date for every Port system.
A November 2024 Port travel advisory said some services remained down, including checkpoint wait-time information online and in the terminal. A Nov. 25 local report said the website had returned, while wait-time features, drive cameras and the Fly SEA app were still being restored. In a Jan. 27, 2025, reply, the airport said work continued on checkpoint wait times and other remaining affected systems. Those milestones distinguish website availability from the recovery of individual features.
The Port’s 2025 financial report says its insurer approved a partial first-party payout of $3.252 million, excluding the deductible. It says the overall claim exceeded available coverage, while uncovered costs did not significantly affect the Port’s financial condition. This is an approved partial recovery, rather than a total-loss estimate or confirmation that payment was received.
A July 17, 2026, court order granted final approval of the data-breach class-action settlement and dismissed the action with prejudice. The order states that the settlement is not an admission of liability or wrongdoing. It does not establish that settlement benefits were paid or identify a final system-restoration date.
Confidence and uncertainty
Data theft and extortion are independently supported. On Sept. 18, Lyttle testified that Rhysida had posted eight stolen files two days earlier and sought 100 bitcoin before releasing more data. He said the Port would not pay and its backups were largely intact. An April 2025 notice reported roughly 90,000 notifications after stolen legacy employee, contractor and parking data were reviewed. Information varied by person and included identifiers and some medical information; payment-processing systems were unaffected.
Ransomware and Rhysida attribution have high confidence because the victim explicitly confirmed them. The 100-bitcoin demand and published samples are supported by testimony, rather than inferred from a tracker listing. The claim record was discovered Sept. 18; that collection date is later than the victim-described Sept. 16 listing. The original actor-post timestamp remains uncertain.
Analytic gaps
The incident is presumed resolved, with no established universal end date. The airport’s Jan. 27, 2025, statement documents continuing recovery of checkpoint wait-time services and other affected systems. Later police and administrative accounts establish extended effects but do not consistently date their latest ongoing condition. Notification, audit and report publication dates do not themselves show continuing disruption. The passenger recovery milestone does not establish when every Port system returned to service.
The reviewed evidence leaves the initial access route, exact intrusion onset, complete stolen-data volume and final restoration dates for all police and internal systems unresolved. Some later video-management difficulties could reflect either attack repercussions or pre-existing software limitations. Those uncertainties limit conclusions about duration and individual systems, while leaving the confirmed ransomware, theft and operational disruption intact.
