Ransomware took Solano County's SPLASH library network offline for weeks

Libraries across Solano County, California lost public computers, Wi-Fi and telephone service on April 5, 2024 after ransomware hit the Solano Partner Libraries and St. Helena network, known as SPLASH. The shared network links branches in Fairfield, Vallejo, Vacaville, Dixon, Suisun City and Rio Vista with the St. Helena Public Library in neighboring Napa County, and serves roughly 450,000 residents.

The attackers demanded $100,000 and threatened to release data they said they had taken. Solano County issued no press release and posted no notice on its website. Chief information officer Tim Flanagan gave reporters only a brief statement, saying "unexpected activity within the library's IT network disrupted the use of certain computer systems," and declined to elaborate while the investigation was open. The chairman of the board of supervisors and the county's public information officer did not answer questions from the Daily Republic.

The county said the library system did not store financial information and that it had no evidence the activity extended beyond library systems. Whether borrower records or other personal data were taken remained undetermined, and outside computer specialists were engaged to investigate.

No restoration timeline was offered. On Friday, April 19, 2024 the county found further unexpected activity on the library network. By Monday, April 22 Wi-Fi, phone and computer service was down at all SPLASH locations and virtual programs were canceled, although the St. Helena branch had returned to normal on April 20. County officials did not confirm whether that disruption was linked to the April 5 ransomware attack. Officials advised library cardholders to watch their financial accounts.