Washington State Courts
Washington court intrusion disrupts statewide systems
Summary
A Washington courts network shutdown disrupted records, filings and dependent services in November 2024. Most applications returned Nov. 18, with recovery continuing in December.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
-
Malware
Malicious software other than ransomware used to compromise or disrupt systems.
Data impacts
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Internet access disruption
The organization lost or materially restricted internet connectivity.
-
Website unavailable
A public-facing website was unavailable, disabled, or inaccessible.
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Application unavailable
A specific application or software platform became unavailable or unusable.
-
Database unavailable
A database or data-management system became unavailable or inaccessible.
-
Payment processing disruption
The organization could not process, receive, issue, reconcile, or record payments normally.
-
Transaction processing disruption
Business, financial, customer, administrative, or operational transactions could not be completed normally.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Records processing disruption
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Event or activity cancellation
Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Backlog created
The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
-
Customer or public access restricted
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
-
Downstream organization impact
The incident caused operational effects at customers, affiliates, subsidiaries, partners, tenants, or other dependent organizations.
Extortion indicators
-
No known extortion indicator
Available evidence indicates that no extortion demand, threat, communication, or related pressure tactic was identified.
Incident narrative
Analyst assessment
DysruptionHub assesses with high confidence that a confirmed network intrusion disrupted Washington’s shared court systems in November 2024. The first reviewed official public cyber announcement was issued Nov. 4; the Oct. 29 malware alert was an earlier internal signal identified retrospectively.
Washington’s Administrative Office of the Courts first received a malware alert on Oct. 29, 2024. According to its official incident timeline, an initial report that the malware had been contained proved incorrect. Continued unauthorized activity prompted the agency to shut down the Judicial Information System and isolate the Washington Courts network from the internet on Nov. 1.
Operational significance
The outage restricted court websites, applications, databases and access to case information. In a Nov. 8 emergency order, the state Supreme Court authorized local deadline adjustments and alternative information sources where the outage hindered proceedings. Chelan County’s clerk reported using paper files and a local document system, with restrictions on electronic filings, case information and some card payments.
Effects varied by court. King County’s Superior Court clerk said its own online systems were unaffected; a separately scheduled migration was responsible for its planned November downtime.
The interruption also delayed Washington State Patrol background checks that depended on court data. In a Nov. 18 release, the patrol said connectivity returned the previous afternoon. Staff completed more than 6,500 backlogged checks during the first eight hours after restoration.
Most Judicial Information System applications returned on Nov. 18. The agency’s statement that day said the Blake Refund Bureau, Appellate Court Document Portal and appellate electronic filing remained offline. Its Dec. 6 committee minutes described further restoration work through the rest of the month.
Confidence and uncertainty
AOC said containment prevented a probable ransomware or data-exfiltration attack. It reported no evidence that court or personal information had been accessed, altered or removed, and said the event did not result in ransomware. The loss of access to court data and services is established independently of those findings.
Confidence is high in the intrusion and documented service losses, based on AOC’s notices and original court and State Patrol records. Those records distinguish the affected shared network from independent systems that continued operating.
Analytic gaps
The incident is presumed resolved. Dec. 6 is the latest specifically dated report of incomplete restoration established in the reviewed records. A precise final restoration date remains unverified. The public record does not identify a responsible actor or establish an earlier initial-compromise time.
Organizations involved
Impacted locations
Olympia, Washington
Preserve Olympia as the administrative/network-operator site anchor. AOC’s official About page and 2026 fact sheet identify its current office at 1300 Quince Street SE; the exact Census street match independently confirms Olympia city5351300, Thurston County53067. This current address does not establish 2024 occupancy, a building-specific outage or intrusion origin. Washington’s non-unified courts operate at multiple locations; Olympia is not the headquarters of every court. https://www.courts.wa.gov/appellate_trial_courts/aocwho/ Olympia boundary independently approved and verified through Ops package e0ee9248-9683-4234-a482-daaf340ad269; saved geometry digest matches the proposed Census city boundary. Geographic profile and complete county/state/country hierarchy audited.
Washington
Washington is the geographic remit of the state judicial system and AOC’s statewide Judicial Information System. The official court directory and AOC About page establish the system/operator distinction. The existing Washington State Courts organization remains the judicial-system umbrella; AOC is its supporting network operator, not an interchangeable legal alias. Paired jurisdiction and impact overlays describe the affected shared system’s remit, without asserting every local court, resident, service or physical facility was interrupted. King County’s own Superior Court/Clerk online systems were unaffected. No federal or tribal systems or independent local-government intrusions inferred. Existing WA geometry and US parent preserved. https://www.courts.wa.gov/appellate_trial_courts/ https://www.courts.wa.gov/appellate_trial_courts/aocwho/
Sources
See something that needs correction?
Signed-in members can report an error, update, or missing source.