West Pierce Fire & Rescue
West Pierce Fire & Rescue cyber incident
Summary
West Pierce Fire & Rescue reported a cybersecurity incident that interrupted email, nonemergency phone lines and other information systems by Dec. 12, 2025. The agency said it detected unauthorized access and worked with the FBI and forensic experts. Fire suppression, EMS and 911 services remained operational.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Unknown cyber mechanism
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
Data impacts
-
Unauthorized data access
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
Operational impacts
-
Email disruption
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
DysruptionHub assesses with high confidence that West Pierce Fire & Rescue experienced unauthorized access and material internal-communications disruption in December 2025. The agency’s Dec. 12 statement identifies the cybersecurity incident, lost email and nonemergency phone access, and its response with the FBI and forensic experts. Our Dec. 13 report adds context on public contact workarounds.
Operational significance
The department could not use some information systems, email or nonemergency phone lines. It directed residents to Facebook for nonemergency contact. The agency explicitly said 911, fire suppression and emergency medical response remained fully operational; the record does not claim emergency-response interruption.
Current status
The agency had not provided a full restoration timeline in the reviewed incident statements. Its current contact page again lists regular office numbers and email, but no reviewed source states when every system was restored. This retrospective incident is presumed resolved without claiming a confirmed all-clear.
Confidence and uncertainty
The victim’s own statement confirms unauthorized access and operational disruption. Ransomware, actor identity, affected data and the complete access window are not established by the reviewed sources.
Analytic gaps
Initial access, attack mechanism, affected data, actor identity and final restoration date remain unresolved.
Organizations involved
Impacted locations
Lakewood, Washington
Lakewood is a physical station community for the affected fire district. Emergency response continued, and no station-specific service loss is asserted.
Supported geographic service remit of the affected fire district; emergency response and 911 continued operating.
Steilacoom, Washington
Supported geographic service remit of the affected fire district; emergency response and 911 continued operating.
University Place, Washington
Supported geographic service remit of the affected fire district; emergency response and 911 continued operating.
University Place contains Station 31 headquarters; this is the affected organization's site anchor, not proof the station itself lost emergency-response capability.
Sources
We reported that West Pierce Fire & Rescue had lost email and nonemergency phone access after unauthorized access, while 911 and response services continued.
The fire district says a cybersecurity incident and unauthorized access disrupted information systems, email and nonemergency phones, while fire, EMS and 911 remained fully operational.
See something that needs correction?
Signed-in members can report an error, update, or missing source.