An April 5, 2024, cyberattack disrupted Solano County Library’s computers, phones, Wi-Fi and record keeping while branches stayed open. Computers and Wi-Fi returned in July. The library now offers mobile printing, but the date of full restoration and Medusa’s data-theft claim remain unresolved.
Unauthorized access to systems, accounts, networks, or data.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
The organization lost or materially restricted internet connectivity.
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.
The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.
The actor threatened to disclose, sell, distribute, or otherwise misuse stolen data unless the victim paid or complied with demands.
The actor explicitly threatened to publish or publicly release victim data or incident details.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The actor published or shared a sample of allegedly stolen victim data to substantiate the extortion claim.
An April 5, 2024, cyberattack disrupted Solano County Library’s shared network in California. The library’s April 5 public notice reported computer, telephone and Wi-Fi outages at all its locations while branches remained open. The notice described the effects without identifying a cyber cause.
In April 15 reporting by the Vallejo Sun, county IT official Tim Flanagan acknowledged unexpected activity affecting library systems and an investigation with outside computer specialists. The report also documented an extortion demand and alleged Medusa activity. An April 19 St. Helena notice explicitly identified a cyberattack on the shared Solano Partner Libraries and St. Helena network, or SPLASH, and a $100,000 ransom demand. St. Helena was a network partner; its statement should not be mistaken for Solano County’s own ransomware confirmation.
The attack interrupted public internet access and internal record keeping across nine Solano County Library locations in Dixon, Fairfield, Suisun City, Rio Vista, Vacaville and Vallejo. Staff used handwritten slips for borrowers, according to the Vallejo Sun. This reduced access to computers and online services while preserving some in-person lending.
StateScoop’s April 22 report described renewed Wi-Fi, telephone and computer disruption and canceled virtual programs after unexpected network activity detected April 19. Officials had not established whether that activity was related to the April 5 attack. St. Helena’s computers, Wi-Fi and phones were working by April 20; its separate cloud system had limited the initial service effects.
By the week of July 26 recovery reporting, public computers and Wi-Fi had returned across the affected library network, including Benicia’s separately operated library. Mobile printing remained unavailable. That establishes substantial partial recovery. The library’s current mobile-printing instructions describe an available replacement service at its branches. They do not date its introduction or establish when all functions recovered.
Confidence in a cyberattack and material service disruption is high. Medusa’s indexed claim identifies the historical solanolibrary.com domain and was discovered April 13. Its alleged 85.02 GB of data is unverified, and the tracker discovery date does not establish the first public outage or the claim’s original publication date.
The Vallejo Sun reported purported sample files and a threat to publish alleged stolen information. Those findings support a documented extortion claim, not independent authentication of the files or a confirmed theft total. St. Helena’s April 19 notice said its services were not directly affected by the initial attack, but raised possible data exposure without confirming a leak. Shared-network membership does not establish identical operational or confidentiality effects for each partner.
The entry method, extent of encryption, authenticated data exposure, any payment and exact final restoration date remain unresolved. The relationship between the initial attack and the later April activity also remains unconfirmed. Historical status remains presumed resolved because the latest dated recovery report still identified an unavailable function. The public outage was documented April 5; county security-specific language and external cyber reporting are verified by April 15, while their precise order remains uncertain.
Medusa’s listing names Solano County Library and solanolibrary.com and was discovered April 13, 2024. It alleges 85.02 GB of stolen data. April 15 local reporting documented a $100,000 demand, a publication threat and purported sample files. The files, volume and actor responsibility remain unverified; discovery is not the original publication date. Partner disclosures corroborate the attack and service effects without proving every actor allegation.
The April 19 partner notice names Fairfield among the six cities with affected Solano County Library branches. This relationship identifies library sites in the city.
Solano County Library’s governmental library-service remit. Shared-network effects are described separately for Benicia; this county overlay does not assert that every library service or location had identical disruption.
The library reported unavailable computers, phones and Wi-Fi at all locations, while branches remained open.
Local reporting quoted the county’s security investigation statement and documented manual lending, an extortion demand and alleged sample files.
The city identified an April5 attack on SPLASH and a ransom demand, while distinguishing its own separate systems and unconfirmed potential data exposure.
StateScoop documented renewed library-system disruption after April19 activity, with its connection to the earlier attack unconfirmed.
Public computers and Wi-Fi returned; mobile printing remained offline.
Medusa’s indexed listing names Solano County Library and its historical solanolibrary.com domain.
The library offers Princh mobile printing and provides printer identifiers for its branches.
Signed-in members can report an error, update, or missing source.
