Pierce County Library System 2025 Data Breach

The PCLS incident statement, as quoted in reporting, says attackers accessed the library network and obtained certain data from its systems. After discovery, the organization investigated the nature and scope and identified affected information types. SecurityWeek independently reviewed the organization notice and regulator filing, reporting the access window, affected groups, and data fields.

The Maine Attorney General filing confirms a notification population of 340,101 and that written notices were being sent. PCLS did not publicly identify the attacker or initial technique, and no known ransomware group claimed the event. Unverified person counts, data fields, and threat-actor claims are not treated as part of the public incident scope.

The investigation determined that threat actors accessed the PCLS network from April 15 through April 21, 2025. Certain data in the systems was acquired during this six-day window. The incident date is based on the earliest technical activity that can be verified from public sources. Discovery and notification happened later, but the affected population is recorded as one incident linked to this access period.

After discovery, PCLS worked to determine the event's nature and scope, identify information that could have been affected, and meet notification duties. Public sources do not describe the first-entry vector, number of affected servers, or precise exfiltration method. Those missing details are not filled with assumptions in this record.

For library patrons, the confirmed fields are names and dates of birth. Sources do not place borrowing histories, reading preferences, library-card passwords, email contents, or payment cards in the verified patron scope. Potentially sensitive library-use records are therefore not added merely because such information could exist in a library service.

A name and date of birth can support targeted phishing, account-recovery abuse, and matching with other datasets. Patrons receiving notices should verify messages that appear to come from PCLS and request additional identifying information. The two fields disclosed for patrons must not be automatically equated with the broader sensitive-data list for employees and family members.

For current and former employees and family members, the possible scope included names and dates of birth plus Social Security, driver's-license, and passport numbers. Financial information and credit-card details were also disclosed as affected categories. These identity and financial fields create lasting risks of identity theft, fraudulent accounts, and payment fraud.

Health-insurance and medical information was also involved for the employee and family group. The organization did not say every field appeared for every affected person, so the classes describe the potential group scope. The record does not imply that medical or financial data was present for all 340,101 people when patrons were publicly associated only with names and birth dates.

PCLS offered affected individuals twelve months of free credit monitoring and identity-protection services. Notice recipients should check the enrollment deadline, review credit reports, and report unfamiliar accounts or transactions. If a Social Security, driver's-license, or passport number was involved, a security freeze, document-agency alert, and tax-account monitoring may be appropriate.

People whose health-insurance or medical information was involved should review statements for unfamiliar services and providers. If credit-card details were identified, replacement or enhanced monitoring can be discussed with the issuer. Calls and messages claiming to be from PCLS should be verified using contact information independently obtained from the official website before any link is opened.

The affected-person or record count published by the official source represents the reported scope of the incident. It does not mean that every disclosed data category applied to every person. The figure covers patrons, employees, and family members; sources did not publish separate counts for each group, so no subgroup totals are invented. data categories are group-specific and do not mean every field appeared for every person.

The entry presents the confirmed network access, theft, official person count, and protection guidance. If PCLS or a regulator publishes a more detailed final report, the entry vector and subgroup scope can be updated from that primary evidence.