Analyst assessment
A Sept. 20, 2024, attack disrupted shared technology supporting Delaware public libraries. Laurel Public Library’s Sept. 20 early-closure announcement is the earliest directly reviewed public outage acknowledgment. The division’s Sept. 21 notice acknowledged a system outage without identifying its cause. The division later explicitly confirmed ransomware to Comparitech.
In Spotlight Delaware’s Sept. 23 report, division director Annie Norman described loss of control of virtual servers supporting public-use computers and a demand for payment. She did not know the exact amount and said she had heard it was about $1 million. Her instruction to rebuild rather than pay is a stated response policy, not verification of the final payment outcome.
Operational significance
Public computer labs and printing were disrupted across the shared library network. WBOC’s Sept. 24 reporting documented a Milford patron unable to print schoolwork and the library director’s account of internet-dependent programs, including English-language classes, not meeting. The Register reported additional telephone, scanning and fax interruptions at Rehoboth Beach and loss of computer, internet and printing services at Georgetown.
Effects varied by service and location. Norman described Wi-Fi as still available but unreliable in the initial reporting; blanket claims that every internet function failed are too broad. Libraries generally continued traditional services. Laurel’s own notices document an early closure on Sept. 20 and continued closure the next day. Lewes’s Sept. 23 notice said the outage affected some, not all, services while recovery and temporary solutions were in progress. Catalog availability and the director’s early reassurance about patron information do not establish that every system or category of information was unaffected.
Confidence and uncertainty
An Oct. 2 staff meeting record says public computers remained unavailable and branch Wi-Fi had returned but was unreliable. Delaware Public Media’s Oct. 11 report quoted the Department of State’s communications director saying Wi-Fi was back and the catalog remained unaffected, while public-PC access needed more time. A county library manager’s report dated Nov. 15 still described the division reimaging public PCs as part of outage repairs. The packet’s Nov. 13 meeting date must not substitute for that attached report’s own date.
Milford’s Oct. 21 board minutes describe computers still down in connection with EnvisionWare and staff using workarounds. The director also lacked QuickBooks access and received financial reports from another staff member. A Nov. 18 board record says a new standalone financial laptop was operational and in use; this confirms a local recovery step, rather than statewide restoration or a separate attack on either software vendor.
The Dec. 4 reference-services meeting notes recorded seven ransomware-related outage inquiries, mostly about computer printing, in November’s statistics. They do not establish an outage on Dec. 4 or the day of each inquiry. A New Castle County manager’s report dated Jan. 8, 2025 says public computers and printers were back online at all library locations, although staff still reported occasional glitches that the division was resolving. That statement describes the county library context, rather than independently confirming every Delaware library. Milford’s Jan. 13 board minutes say printing was available while staff trained on a new internet system. Jan. 8 is the latest precisely dated ongoing technical effect established here; neither record identifies an exact statewide completion date.
The division’s Jan. 8 staff meeting notes record computers and printing restored at nine named libraries, including Laurel, Lewes, Millsboro, Smyrna and the county-run Milton and South Coastal branches. The same notes tally five ransomware-related outage inquiries in December. These reports establish local recovery bounds, rather than an exact statewide restoration date.
Milford’s Feb. 10, 2025, board minutes document financial effects beyond the service outage. The library reported $1,000 in state assistance and attributed lower operating income to its earlier inability to serve patrons. It also linked unexpected staff-printer replacement and toner costs to the server hack and hardware reimaging. The minutes’ $5,575 revised toner-and-paper estimate is a budget category, rather than a total incident cost; the report does not establish a continuing outage on Feb. 10.
Analytic gaps
RansomHub’s matching domain listing was discovered by a public tracker on Sept. 24 at 7:21 p.m. Eastern; that is a tracker observation, not a verified original publication time. Reports described an alleged 56.4 GB theft and purported financial-document samples. Attribution and those data claims remain low confidence without victim or forensic confirmation. The actor’s mention of the former Library for the Blind and Physically Handicapped name does not establish a separate intrusion or its intended target.
Sept. 20 is both the stated disruptive event date and the earliest directly reviewed public outage acknowledgment; Sept. 23 remains the earliest reviewed cyber characterization. The Sept. 23 article combines external reporting with the director’s acknowledgment; a distinct earlier public institutional cyber acknowledgment was not established, so the cyber-transparency component remains unresolved. The initial access method, verified data scope and full restoration remain gaps. The July 2024 statewide IT outage and similarly named out-of-state library systems are separate events.
