More than 340,000 impacted by cyberattack on library in large Washington county

A cyberattack on the library system of Pierce County, Washington exposed the information of more than 340,000 people.

The Pierce County Library System published breach notifications this week on its website and with regulators in several states. The letters concern a cybersecurity incident that was first discovered on April 21 and required the library system to shut down all of its systems. 

By May 12, the organization confirmed that hackers breached their systems and stole information on employees and customers of the library – which has 19 locations and serves a county population of nearly 1 million people outside of Seattle. 

The letter says an investigation revealed the hackers had access to organization systems between April 15 and April 21. The information stolen varied between patrons of the library system and current or former employees. For those who use the library’s services, their names and dates of birth were leaked. 

For current or former employees, the data stolen includes Social Security numbers, financial account information, driver’s license numbers, credit card information, passport numbers, health insurance information and medical data. 

The attack was claimed by the INC ransomware gang in May. The group has launched several damaging attacks on government systems in 2025, including attacks on the Pennsylvania Office of the Attorney General and an emergency warning service used by municipalities across the U.S.

Pierce County previously dealt with a ransomware attack in 2023 on its public bus service that disrupted a system used by 18,000 people per day. 

Public library systems have repeatedly faced attack in recent years by ransomware gangs that believe demand for access to online library services will force governments to pay ransoms. 

In addition to high-profile attacks on massive systems like the British Library, multiple libraries across Canada and the U.S. have dealt with outages caused by ransomware attacks.  

The attacks on libraries across the globe has even prompted U.S. officials to propose the creation of a program specifically designed to collect data about the cybersecurity and advanced firewall services that would best help libraries defend themselves from hackers.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Jonathan Greig

Jonathan Greig

is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

 

Total
0
Shares
Previous Post

Fake OSINT and GPT Utility GitHub Repos Spread PyStoreRAT Malware Payloads

Next Post

Hamas-affiliated APT targeting government agencies in the Middle East, Morocco

Related Posts

MongoDB Vulnerability CVE-2025-14847 Under Active Exploitation Worldwide

A recently disclosed security vulnerability in MongoDB has come under active exploitation in the wild, with over 87,000 potentially susceptible instances identified across the world. The vulnerability in question is CVE-2025-14847 (CVSS score: 8.7), which allows an unauthenticated attacker to remotely leak sensitive data from the MongoDB server memory. It has been codenamed MongoBleed. "A flaw
Read More

Russian APT28 Runs Credential-Stealing Campaign Targeting Energy and Policy Organizations

Russian state-sponsored threat actors have been linked to a fresh set of credential harvesting attacks targeting individuals associated with a Turkish energy and nuclear research agency, as well as staff affiliated with a European think tank and organizations in North Macedonia and Uzbekistan. The activity has been attributed to APT28 (aka BlueDelta), which was attributed to a "sustained"
Read More

Asian State-Backed Group TGR-STA-1030 Breaches 70 Government, Infrastructure Entities

A previously undocumented cyber espionage group operating from Asia broke into the networks of at least 70 government and critical infrastructure organizations across 37 countries over the past year, according to new findings from Palo Alto Networks Unit 42. In addition, the hacking crew has been observed conducting active reconnaissance against government infrastructure associated with 155
Read More