The British Library is the national library of the United Kingdom and one of the world’s largest libraries. In the fall of 2023, it fell victim to a major ransomware attack that severely disrupted its operations and compromised sensitive data.
The institution decided on a strategy of full transparency and produced and published a detailed report into the causes and nature of the attack and initial recovery. The report offers important lessons for all organizations about cybersecurity vulnerabilities and crisis management. In this article, we have summarized the report’s key findings and added our own perspective and advice on the issues it raises.
On 28 October 2023, it became clear that the British Library had been hit by a ransomware attack that compromised most of its online systems. The attack, claimed by the Rhysida ransomware gang, exfiltrated data, encrypted or destroyed substantial portions of the Library’s server estate, and forcibly locked out all users from the network.
Forensic analysis indicates the attackers likely first gained access at least three days before the incident became apparent, conducting initial reconnaissance of the network. The exact point of entry could not be definitively determined, but a terminal server used for remote access by trusted partners is believed to be the source. The lack of multi-factor authentication on this server is thought to have contributed to the attackers’ ability to gain entry.
The attackers exfiltrated approximately 600GB of data – nearly 500,000 files – many from the Library’s CRM (Customer Relationship Management) database, including personal data of Library users and staff. They used targeted attacks to copy records wholesale from certain departments, as well as keyword searches to identify potentially sensitive files across the network. Multiple databases were also compromised but financial data appeared to be absent from the leak.
A few days after the attack, the Rhysida gang leaked internal HR documents on the dark web, potentially including employee passport scans and contracts. The hackers then initiated a week-long auction for the stolen data, demanding 20 bitcoin (about £600,000) for the full dataset.
Subsequently, Rhysida published 573GB of data – roughly 90% of the total stolen – on their dark web site. This suggests they failed to sell the full dataset and indicates the Library didn’t negotiate or comply with their demands, aligning with best practices for ransomware attacks.
In addition to data theft, the attackers encrypted data and systems and destroyed some servers, severely hampering the Library’s ability to recover its infrastructure. While secure backups of digital collections and metadata existed, the lack of viable infrastructure on which to restore this data was a major obstacle to recovery.
“Even after the launch of a searchable online catalog in January 2024, many digital services remained unavailable.”
The attack had an extensive impact across all areas of Library activity. While the physical premises remained open, research services were severely restricted for months. Even after the launch of a searchable online catalog in January 2024, many digital services remained unavailable.
Key systems could not be restored to their previous form, either due to a lack of vendor support or incompatibility with the new secure infrastructure. Cloud-based systems like email, finance, and HR were largely unaffected. The Library continues to work to achieve the full recovery of systems and services and expects some of its most popular services will be running again during September.
The British Library was officially created in 1973 by the British Library Act, but its origins date back much further.
It serves scholars, researchers, students, and the general public, holding over 170 million items in multiple languages and formats, including books, manuscripts, maps, newspapers, magazines, prints, drawings, music scores, and digital materials. It is based in St Pancras, an area of central London.
Legal deposit library: Receives a copy of every publication produced in the UK and Ireland
Research: Supports researchers with vast collections spanning all subjects and many centuries
Preservation: Conserves and digitizes millions of items to ensure long-term access
Cultural heritage: Holds many of the world’s most significant historical texts and artifacts
Public engagement: Hosts exhibitions, events, and educational programs
Digital services: Provides online access to many resources and catalogs
International collaboration: Partners with institutions worldwide for research and cultural exchange
The incident significantly disrupted the Library’s ability to fulfill its main roles (see box above) across multiple areas. Its work on custodianship, preservation, and access to digital collections was severely impacted, and legal deposit intake was also disrupted. Research activities were hampered as researchers faced major restrictions on collection access, with many digital resources remaining unavailable for months due to the hack across a range of legacy systems.
Physical collections remained secure, and some business operations continued but with limitations, particularly in marketing capabilities. Cultural activities fared somewhat better, with exhibitions and events continuing successfully through various workarounds. Learning initiatives were affected, as on-site activities continued but online resources were unavailable. Finally, in the international sphere, most activities continued, though some partnerships experienced delays due to the disruption.
The library immediately activated its crisis management plans, convening its central and tactical (Gold and Silver) committees to provide strategic and operational management of the incident. External cybersecurity advisors were brought in to assist. Communication with users, staff, and stakeholders was coordinated via social media and other channels, with care taken not to share details that could aid the attackers.
In December 2023, the Library transitioned from crisis response to a formal recovery program called Rebuild & Renew. This 18-month initiative aims to not just restore disrupted services but strategically modernize and enhance Library operations to build greater long-term resilience.
“Manual data transfer processes between older systems also increased the volume of sensitive data exposed on the network.”
The British Library’s historically complex and diverse technology infrastructure likely contributed to the severity of the attack’s impact. Legacy systems and a complex network topology allowed attackers wider access than a more modern architecture would have permitted. Manual data transfer processes between older systems also increased the volume of sensitive data exposed on the network.
The reliance on legacy infrastructure is the primary reason for the extended recovery time, as many systems need to be migrated, modified, or entirely rebuilt to function in a modern secure environment. This highlights the importance of continual investment to keep infrastructure and applications current.
These ongoing risks highlight the need for continued vigilance and adaptability in the library's cybersecurity strategy.
The library is leveraging the recovery process as an opportunity to implement wide-ranging improvements to its technology infrastructure and security practices. These enhancements include implementing a best-practice network design with proper segmentation, adopting a hybrid cloud computing model, and enhancing access controls and multi-factor authentication. The library is also improving backup and disaster recovery capabilities, deploying an integrated, holistic security suite, strengthening policies and governance around IT lifecycles, and consolidating key library systems onto modern, secure platforms.
Several risks will require ongoing attention as the library may face an increased threat of future attacks while embedding a security-focused culture across the organization will require a significant change management effort.
Additionally, the technology department faces major capacity and capability challenges to deliver the recovery program, and the shift to greater cloud adoption introduces new security considerations. These ongoing risks highlight the need for continued vigilance and adaptability in the library’s cybersecurity strategy.
The British Library’s experience offers several key lessons for businesses as well as cultural, not-for-profit, and research institutions:
1. Enhance network monitoring capabilities to ensure full coverage across legacy and modern infrastructure.
2. Retain on-call external security expertise to enable rapid incident response.
3. Implement multi-factor authentication comprehensively, including on all external access points.
4. Conduct in-depth security reviews regularly.
5. Implement network segmentation to limit potential damage from breaches.
6. Regularly practice business continuity plans for total system outages.
7. Maintain a regularly updated and holistic view of cyber risks at senior management and supervisory board levels. This is also important from a compliance and governance perspective.
8. Focus on resilience and invest in response and recovery processes, recognizing that it’s not always possible to understand or “fix” the root cause of an intrusion.
9. Prepare for ransomware as a damage minimization game. Even with preparation, there will be damaging impacts, but the extent depends on the level of preparedness.
10. Conduct and publish detailed impact assessments of attacks on an organization’s core purposes, as exemplified by the British Library’s report.
This level of principled reporting should be considered exemplary for all organizations, public and private alike.
The British Library’s approach to post-event reporting and transparency sets a new standard for best practices in cybersecurity incident reporting. Their detailed assessment of the attack’s impact on the library’s core purposes is particularly commendable. This level of principled reporting should be considered exemplary for all organizations, public and private alike. Some of the generic lessons learned show that an organization doesn’t need to be non-profit to benefit from such a thorough and transparent account.
While the British Library is a public institution, transparency related to a cyber-attack also played out positively for a large manufacturing business.
In March 2019, Hydro, a Norwegian renewable energy and aluminum manufacturer, fell victim to a LockerGoga ransomware attack that crippled its global operations. The company decided not to pay the ransom and instead opted for a transparent approach to managing the crisis.
Hydro shut down its entire network, warned employees not to log in, and shifted to manual operations to keep production going. The company held daily press conferences and internal briefings, inviting journalists to observe their response efforts. They also used social media and fast-tracked a new website to communicate with customers and the public.
The recovery involved three teams working with Microsoft and the Norwegian National Cyber Security Center to investigate the virus, restore operations, and rebuild the network. This process took several weeks for essential systems and months for less critical ones.
The attack cost Hydro more than $80m and disrupted production for 6-8 weeks. It also highlighted the ongoing challenges in combating ransomware and the complex interplay between cybercrime, cryptocurrencies, and insurance policies.
Hydro’s response was praised as “gold standard” by law enforcement and the cybersecurity industry. Their share price increased after the attack was made public, suggesting market confidence in their approach. The openness and transparency of the response was also recognized with communications industry awards.
The British Library’s report goes beyond merely explaining what happened and why; it also outlines lessons learned and planned changes. This comprehensive approach should be considered standard practice and could potentially be incorporated into government expectations for private companies when they experience a breach.
The attack demonstrates that even institutions with extensive security measures can fall victim to sophisticated cyber criminals. Continual investment in modernizing infrastructure, enhancing security controls, and fostering a security-conscious culture is essential. The potential costs of prevention are far outweighed by the devastating impact of a successful attack on an institution’s operations and reputation.
It’s crucial to note that the British Library did the legally and morally right thing by not paying the ransom. However, they still suffered significant consequences, underscoring that ransomware attacks often become a process of damage minimization. Regardless of how well an organization is prepared for an attack, there will be damaging impacts, but the extent of the damage largely depends on the level of preparedness.
As our global cultural and intellectual heritage becomes increasingly digital, protecting these assets from cyber threats must be a top priority for institutions and policymakers alike. The British Library’s transparent and detailed reporting of this incident serves as a valuable learning opportunity for other organizations and could significantly improve cybersecurity practices and resilience across sectors if widely adopted.
David Michels, CFO at Kinder Morgan, a leading US energy infrastructure company, explores how rapid AI and data center growth have quickly reshaped energy demand and what CFOs can do to navigate...
The ability of women to empathize and act ethically and responsibly makes them ideally placed to lead us into a future where AI benefits all society, not just the wealthy....
Audio available
Many new businesses have emerged in recent years with few employees, no roots in the community, and heavily reliant on Big Tech for survival. How does this square with the demands for...
Audio available
With fact-checking out and community-driven moderation in, Meta is betting big on free speech – but critics warn the move could open the floodgates for disinformation and online harm....
Explore first person business intelligence from top minds curated for a global executive audience