Port of Seattle portseattle.org Port of Seattle data breach: what happened and what to do
The Port of Seattle confirmed in April 2025 that a ransomware attack in August 2024 affected about 90,000 people, mostly current and former employees and contractors. Names, dates of birth, Social Security numbers and ID numbers were exposed.
View all 13,115 breaches- Breach date
- 3 Jul 2024
- Made public
- 3 Apr 2025
- Affected
- 90,000
- Data exposed
- Names, Dates of birth, Social security numbers, Government issued IDs, Medical information
- Last updated
What happened
The Port of Seattle, which runs Seattle-Tacoma International Airport and the city's seaport, was hit by a ransomware attack in August 2024. In April 2025 it confirmed that the breach affected about 90,000 people, around 71,000 of them Washington residents. Most were current or former Port employees, contractors or airport staff.
The Port linked the attack to the Rhysida ransomware group. The attackers got into legacy systems used for employee data. They demanded a $6 million ransom. The Port refused to pay.
What was exposed
The compromised data includes names, dates of birth, Social Security numbers (or partial numbers), driver's license or other government ID numbers and, in some cases, medical information.
What it means for you
If you worked at or for the Port, this is the full set an identity thief needs: your name, birth date and Social Security number. Criminals use that to open credit, file fraudulent tax returns or take over accounts. Medical details raise the odds of targeted phishing about your health or benefits.
The company's response
The Port offered one year of free credit monitoring and identity theft protection to affected people.
What to do if you were in it
- 1
Freeze your credit
A freeze at Equifax, Experian and TransUnion stops anyone opening new credit in your name. It's free, takes a few minutes per bureau and you can lift it when you need to borrow.
- 2
Take the free monitoring if you were offered it
If the Port of Seattle sent you a letter with an enrollment code, use it before the deadline. It adds alerts on top of a freeze, it doesn't replace one.
- 3
Read your statements and explanations of benefits
Look for accounts, loans, claims or tax filings you don't recognize, and report them to the lender, insurer or the IRS right away.
- 4
Expect phishing that mentions the breach
Scammers pose as the Port of Seattle or as a credit monitoring service. Don't click links in unexpected texts or emails, and call the number on the letter or the official website instead.
- 5
Check whether your email or phone is in this and other breaches
A free Serus scan shows where your email address and phone number have appeared in known breaches and tells you what to do next.
Frequently asked
Was I affected?
About 90,000 people were notified, mostly current and former employees, contractors and airport staff. If you got a letter from the Port, you were.
What was exposed?
Names, dates of birth, full or partial Social Security numbers, driver's license or other government ID numbers and, for some people, medical information.
Did the Port pay the ransom?
No. The Port said paying the criminal group wouldn't reflect its values or its duty as a steward of taxpayer dollars.
Should I change my password?
The notice centres on employee records, not passwords. Freezing your credit matters more.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
