Cyber Incident Victim: Pierce County Library System
Date:
Dec 2025
Location:
United States of America
Summary
The Pierce County Library System in Washington suffered a cyberattack that exposed the personal information of over 340,000 individuals and was attributed to the INC ransomware gang, leading to a complete shutdown of its systems. The breach disrupted library services and prompted the organization to take all IT systems offline while responding to the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
The BSafes Library outage documentation includes an article dated April 7, 2026, that contains an entry about the Pierce County Library System. The article is titled "Outage | BSafes Library" and is accessible at the URL https://library.bsafes.com/docs/issues/outage/outage. Within that article, a specific entry is dated December 15, 2025. The entry carries the headline "More than 340,000 impacted by cyberattack on library in large Washington county". The abstract of that entry describes a cyberattack on the Pierce County Library System in Washington.
The abstract states that the breach exposed the personal information of over 340,000 individuals. It attributes the attack to the INC ransomware gang. The incident occurred on December 15, 2025, according to the entry's date. The Pierce County Library System is located in Washington state. The abstract indicates that the attack forced the library system to shut down all its systems.
The shutdown of all systems was presented as a direct consequence of the cyberattack. No further details about the attack vector, duration of the outage, or restoration timeline are provided in the source. The abstract does not mention any ransom payment or negotiation with the attackers. It also does not specify which categories of personal data were compromised. The only quantified impact given is the number of individuals whose information was exposed. Thus the known facts are limited to the date, location, attribution, exposure count, and system shutdown.