Cyber News: What You Need to Know, Port of Seattle Cyber Attack
In this week’s edition of Cyber News, we’re breaking down the Port of Seattle cyber attack – what went wrong, what went right, and everything in between.
How It Started
On August 24, 2024, the Port of Seattle identified systems outages consistent with a cyberattack, originating from an operator within the Seattle-Tacoma International Airport. The Port of Seattle owns both the port and the airport. In an interview with the US Senate Committee on Commerce, Science, and Transportation on September 18, the Aviation Managing Director, Lance Lyttle, stated that “paying ransomware to a criminal organization does not reflect Port values.”
The Russian criminal group, Rhysida, is claiming responsibility for the attack, and originally demanded $6 million worth of Bitcoin, which is roughly 100 Bitcoin. The attack caused outages due to limited internet access. The airport-wide WiFi also went down. It also affected the baggage system, causing extremely long lines for checked bags.
The attackers were able to encrypt access to some data before the port was able to successfully disconnect its systems from the Internet. Between the attack and the encryption, the baggage system, check-in kiosks, ticketing, WiFi and more were affected.
What Went Wrong
The attackers posted their copy of eight files stolen from the port’s systems to the dark web on Monday, September 16, after the Port refused to pay their ransom demands. Lyttle said the Port is cooperating with the FBI and is making the proper notifications for any individuals whose information was included in the attack.
The purported documents stolen from the organization, based on the images included in the file, appear to be a scan of a US passport, tax identification forms including Social Security numbers, and other PII.
What made the attack especially effective was the fact that SEA is having a record year. The airport is designed to sustainably handle roughly 30 million passengers annually, but is currently tracking at 54 million for this year. Another outlier is major renovation projects currently underway to accommodate the growth.
The Messy Middle
Washington Senator Maria Cantwell (D-WA) in the Senate hearing on Wednesday, September 18, pointed to the FAA Reauthorization Act of 2024, which was recently signed into law. The law includes specific provisions to strengthen infrastructure and cybersecurity under the FAA. More importantly, however, is that it directs the FAA to establish a process to identify aviation cyber threats.
The senator also cited statistics indicating cyberattacks on frequent flier accounts are up 166% this year.
“Brittle infrastructure won’t cut it,” she said.
What Went Right
- The Port refused to pay the demand.
This is perhaps one of the best points of what went right in this scenario. By refusing to pay the demand, and doing so quite publicly, the Port Authority sends a very strong message that these attacks will not be successful in gaining both the attention and financial satisfaction the cybercrime groups want. - The Port had a disaster recovery plan in place and executed it.
The key to this whole event is the resiliency that the Seattle Port was able to demonstrate with the success of business continuity and disaster recovery plan to restore services with minimal impact. This also benefited them by refusing to have to pay for the data to be returned – they already had it. It also appears that no sensitive data was compromised resulting in little loss of revenue as well as liability. - The Port disconnected from the internet and isolated critical systems.
This critical step isolated the event and kept the impacts to a minimum. Even though the impacts were obviously felt – I mean no one likes long lines when you’re trying to get somewhere – they could have been much worse. - Majority of systems were safely brought back online within a week.
Because of their data backups and business recovery plan, they were able to get online and back to normal as soon as safely feasible. - The website remains down.
While this does cause some impact to their business, keeping the website offline until cleared to do so is the smart move. They’re also providing as much information and resources for the public on the page that is up.
This is a great case study and an example of both cyber terrorism on infrastructure and the successful execution of a business disaster recovery strategy.