Hackers Demand 100 BTC After Breaching Seattle-Tacoma Airport’s Network

Hackers have demanded a ransom of 100 BTC after successfully infiltrating the computer systems of Seattle-Tacoma Airport. The ransomware used in the attack is identified as Rhysida. Despite the hackers’ demands, the airport’s management firmly stated that they would not be paying the ransom, which is currently valued at approximately $6.4 million.

The Attack and Its Impact

On August 24, 2024, a significant cyberattack targeted the computer infrastructure of Seattle-Tacoma Airport. Lance Little, the Managing Director of Aviation at Seattle-Tacoma, disclosed the details during a testimony before the Senate Committee on Commerce, Science, and Transportation. While the airport’s specialists managed to maintain control over most critical systems, a portion of the data was encrypted by the hackers using Rhysida ransomware.

About Rhysida Ransomware

Rhysida ransomware, first detected in mid-2023, employs a cryptographically strong pseudorandom number generator (CSPRNG) for generating encryption keys. This robustness makes it challenging to counteract. The ransomware’s operators have released eight files on the dark web, allegedly stolen from the airport’s network, and have threatened to release more data if their demands are not met. The airport acknowledged that personal data of passengers and staff might have been compromised during the attack.

Response from Seattle-Tacoma Airport

Lance Little criticized the idea of paying the ransom, considering it a poor use of taxpayer money. He emphasized that the airport is diligently working to restore the affected systems and is gradually returning to normal operations.

Developments in Rhysida Decryption

In February 2024, South Korean researchers identified a vulnerability in Rhysida ransomware. This breakthrough allowed them to develop a free decryption tool for Windows operating systems, enabling the restoration of affected files.

FBI’s Involvement and Broader Implications

The Federal Bureau of Investigation (FBI) has opened a criminal investigation into the breach of Seattle-Tacoma Airport’s infrastructure. This incident is part of a broader trend, as highlighted by the FBI’s annual report on financial fraud, which noted that in 2023, U.S. residents lost $5.6 billion in cryptocurrency due to hacker attacks.
The Seattle-Tacoma Airport breach underscores the growing threat of ransomware attacks in critical infrastructure sectors. The refusal to pay the ransom aligns with broader cybersecurity strategies aimed at discouraging such extortion attempts. Meanwhile, the development of decryption tools, like the one for Rhysida, represents a significant advancement in combating ransomware. As the cryptocurrency landscape evolves, the importance of robust cybersecurity measures and international collaboration in addressing cyber threats becomes increasingly evident.