The full return of services at Seattle’s 27 public libraries is still weeks or even months away, the library said Thursday, as it continues to try to recover after announcing a month ago that it had been hit by a ransomware attack.
“We are still looking at weeks and even months to get every single thing back to the way it was,” Chief Librarian Tom Fay said at a meeting of the library’s board of trustees Thursday.
Fay said the library hopes to release a timeline next week of when it thinks services will return.
The library’s public computers have been unavailable for a month. So have its public Wi-Fi networks. Books are being checked out by spreadsheet. And librarians are asking patrons to not return books — for now — because they don’t have a way to check books back into the system.
The library’s catalog is searchable, just not from any of its own computers. And patrons can’t access their library accounts or place requests or holds on books and other materials. The library has had to switch to manual time sheets and payrolls to pay its staff.
Fay said the library was working on “thousands of [computer] devices that need to be reimaged, repaired, recovered.”
“Those are just devices, not software packages, other services,” Fay added, saying that library staff’s “efforts right now are fairly herculean.”
Ransomware is an attack where hackers get into a computer system and then demand payment in return either for returning the system, or for not releasing private data, or both.
Fay said that library staff, this week, began using multifactor authentication to log into the library’s network, and about 70% of the staff has completed an orientation in that process.
He also said it would be weeks or months before the library is able to determine whether personal data was stolen by hackers in the attack, and if so, to what extent. The library has said that it will notify individuals directly if their personal data was accessed.
The library, in an update Thursday, said “a very small number” of staff members had their personal information downloaded as part of the attack.
“We have notified these employees directly and have provided supportive resources, including a 24-month membership to a credit and identity monitoring service,” the library wrote in a prepared statement.
Fay offered few new details on the nature of the ransomware attack, which was first identified over Memorial Day weekend. The library has been largely silent on the subject — declining to say what attackers have demanded, whether it’s negotiating with the attackers or who it’s contracted with to address the issue. The library has said it is working with the FBI to address the attack. Library officials have said they don’t want any public statements or new information to lead to an escalation by the attackers.
A report released this year by Sophos, a British cybersecurity firm, found that the median ransomware demand in organizations it surveyed was $2 million. More than half of surveyed organizations reported they paid at least some ransom to restore access to their data.
Last year a ransomware attack on Toronto’s library took more than four months to resolve. It shut down nearly 5,000 library computers and, when it was finally over, left the library with a backlog of 1 million books to reshelve.
The British Library was also hit by a ransomware attack last year that left its catalog crippled for three months. Hackers copied and stole 600 gigabytes of files and, when the library refused to pay a ransom, put the data up for auction and then dumped it on the dark web, the library wrote in a report on the attack. In the report, issued about six months after the attack was first identified, the library said it was still working to rebuild its computer infrastructure.
Yazmin Mehdi, one of the five members of the Seattle library’s board of trustees, said the attack was a moment for the public to appreciate all the services the library provides, calling it a “tiny, tiny silver lining.”
“This malicious actor sucks big time,” Mehdi said. “I hope that it will help people understand why we need to put forth a new levy in 2026 and continue to ensure that the library has the funding that it needs.”
The library is in the midst of a seven-year, $219 million property tax levy that was approved overwhelmingly by Seattle voters in 2019.
The levy provides about 30% of the library’s $102 million annual budget. The library spends about $7 million a year on information technology.
