iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The Port of Seattle first reported a “possible cyberattack” on August 24, 2024. It later identified the incident as a Rhysida ransomware attack, and in April 2025 said attackers had accessed and downloaded some personal information. Airport services were disrupted, but the Port said people could travel safely and that major airline and federal partner systems were not affected.
What happened at Sea-Tac Airport?
On August 24, 2024, the Port of Seattle reported system outages that it said were consistent with a cyberattack. The Port isolated critical systems and worked with third-party and federal partners to restore and test services. Its initial update described a “possible cyberattack”; on September 13, the Port characterized the incident as a ransomware attack by the criminal organization Rhysida. These are the Port’s public descriptions of the incident.
The Port said the attack encrypted access to some data. Its containment measures, including disconnecting systems from the internet, also interrupted services at Seattle-Tacoma International Airport (SEA) and in maritime operations. The Port said its effort to stop the attack appeared successful and that it had seen no new unauthorized activity since August 24, according to its September 13, 2024 update. That was the status reported at that time, not a guarantee about current security.
Airport services that were disrupted
The Port listed baggage messaging, check-in kiosks, ticketing, Wi-Fi, passenger display boards, the Port website, the flySEA app, and reserved parking among the affected services. The outages and recovery work created operational friction even though the Port said air travel remained safe.
#1 Best Overall
Was Sea-Tac hacked, and were flights safe?
In the everyday sense, yes: the Port later said Rhysida carried out a ransomware attack against its network. The Port did not publicly establish the technical entry path in the cited incident materials, so claims about how the attackers first got in would be speculation.
The Port said the incident did not affect the ability to travel safely to or from SEA or to use maritime facilities safely. It also said proprietary systems belonging to major airline and cruise partners, as well as federal partners including the FAA, TSA, and Customs and Border Protection, were not affected. Those statements describe what the Port reported; they do not mean airport services experienced no disruption.
How airport staff handled disruptions
In prepared testimony to a U.S. Senate committee in 2024, SEA Aviation Managing Director Lance Lyttle said staff used paper boarding passes and baggage tickets for some carriers and moved luggage manually. Lyttle reported that Port employees from aviation and maritime divisions contributed more than 4,000 hours over ten days, and that staff moved more than 7,000 bags manually during the first days. He said most airport operational systems were back online within a week, though delays occurred, particularly while part of the baggage system was down. These are figures and a recovery timeframe from Lyttle’s testimony, not independently audited metrics.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →What information was exposed in the Port of Seattle cyberattack?
On April 3, 2025, the Port said its investigation was complete and that threat actors had accessed and downloaded some personal information. The data came from previously used systems for employee, contractor, and parking records. Depending on the person, information potentially involved included:
- Names and dates of birth
- Social Security numbers or the last four digits
- Government identification numbers
- Some medical information
These categories describe information that could have been involved; the Port did not say that every affected person had every listed data type exposed. The Port said it held very little passenger information and that payment-processing systems were not affected.
How do I know if my information was affected?
The Port said it was sending approximately 90,000 individual notifications to people for whom it had available mailing addresses. About 71,000 of those people lived in Washington. The notification count does not establish that any particular reader was affected; the Port’s notice to an individual is the relevant confirmation.
People who received a notification should follow the instructions in their letter, which the Port said included access details for one year of comprehensive credit monitoring and identity-theft protection. The Port’s archived incident notice advised people who had given it personal information before August 24, 2024, and were concerned they might be affected, to monitor their accounts and credit histories. It also provided information about free credit reports, fraud alerts, and security freezes.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsFor individual guidance, use the Port’s official cybersecurity incident resources and the instructions in any notice you received. Do not assume that having traveled through SEA means your information was included.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What happened after the initial recovery?
A Port Internal Audit report covering Maritime operations from August 2024 through August 2025 examined revenue billing and payroll processes. It said manual maritime processes meant revenue monitoring and accounting were minimally impacted, but the PeopleSoft system being offline delayed customer billings.
For payroll, the report said the Port temporarily relied on prior-paycheck amounts for one pay period and then used spreadsheets. Reconciliations identified adjustments, and payroll returned to normal operations by early 2025. The audit’s findings applied to selected tested items and should not be extrapolated to all Port operations or records.
What the public record does—and does not—establish
The chronology is clear: an outage report on August 24, 2024; the Port’s ransomware characterization on September 13; and a personal-data notification announcement on April 3, 2025. The Port and Lyttle’s testimony described service disruptions and recovery actions, while the Port’s 2025 notice described data access and notification. The cited public materials do not establish the attackers’ initial access method, nor do they identify which data types were involved for every individual.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
