Officials at the British Library are working round-the-clock to restore services following a major ransomware attack, but it could take several months for the library to resume normal operations.
On 28th October, the British Library announced on social platform X, formerly Twitter, that it was “experiencing technical issues” that affected its official website. The technical outage also affected its sites across London and Yorkshire and left its phone lines and on-site services, including visitor Wi-Fi and electronic payments, offline.
Later, it confirmed that the technical outage was a result of a ransomware attack that affected its website, online systems, and services. The library added that some internal data from its HR department has also been exfiltrated by malicious actors.
The notorious Rhysida ransomware group claimed responsibility for the data security incident and added the British Library as a victim on its data leak site. The group gave the library a deadline of six days to pay a ransom of 20 Bitcoin, or £587,202(US$744,807.02), failing which the group had threatened to publish the stolen data.
The chief executive of the British Library, Sir Roly Keating said in a blog post that the ransomware attack had a far-reaching impact on the library’s operations and it could take several months for the Library to completely restore its services.
“We took immediate action to isolate and protect our network but significant damage was already done: having breached our systems, the attackers had destroyed their route of entry and much else besides, encrypting or deleting parts of our IT estate,” Keating said. “They also copied a significant chunk of our data, which they attempted to auction online and, a month later, released most of it onto their site on the dark web.”
While forensic investigation of the ransomware attack is still ongoing, Library authorities and relevant law enforcement authorities have identified that at least 600 gigabytes of internal data was stolen from its internal network and dumped online for sale by the threat actors.
While the British Library’s internal IT team is in the process of analysing the compromised data, analysts noted that the Library’s popular EThOS collection of more than 600,000 doctoral theses is unavailable.
The impact of the attack was also felt in the Reading Rooms of the London and Yorkshire outlets where readers could not retrieve collection items, and free access to the Library collection had to be put on hold. Essential digital services including the British Library catalogue, its website and online learning resources were unavailable too.
Sir Keating added that the British Library is working with the Metropolitan Police and professional cyber security advisors to investigate the situation, and are receiving additional support from the National Cyber Security Centre (NCSC).
The Library is also in the process of developing hybrid services and workarounds to regain access to its collection. It plans to put a stronger security infrastructure in place while strengthening its existing one to avoid such disruptions should it suffer any security incidents in the future.
“From early in the new year you will begin to see a phased return of certain key services, starting with the most crucial of all, our main catalogue, a reference-only version of which will be back online from January15, further facilitating the manual ordering which is already available in our Reading Rooms,” Sir Keating said.
“Other interim services will include increased on-site access to our manuscripts and special collections, and a bespoke inter-library loan capability designed to serve key sectors such as health, higher education and law,” he added.
