Glossary term
Ransomware
Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.
Read more
Significant cyber incident
British Library ransomware attack
The British Library ransomware attack began on Saturday 28 October 2023, when the Library found that ransomware had hit most of its online systems.
In short
The British Library ransomware attack began on Saturday 28 October 2023, when the Library found that ransomware had hit most of its online systems. The Library says the Rhysida gang claimed it. The attackers copied about 600GB of files, locked users out and destroyed some servers to stop recovery. The Library did not pay, and the stolen data was later dumped on the dark web.
What happened
On Saturday 28 October 2023 it became clear that the British Library had been hit by a significant ransomware attack. The Library’s own review says the attack exfiltrated data, encrypted or destroyed large parts of its server estate and locked all users out of the network. The first major-incident alert came at 07:35 that morning, when a member of the Technology Team could not get into the network.
The Library says forensic work showed an outside presence on its network on the night of 25 October, and that this was probably hostile reconnaissance before the main attack. A monitoring system had blocked the activity, and a password reset followed, but no malicious activity was clearly identified at the time. On 28 October the attackers took about 600GB of files, which the Library says is just under half a million documents.
The Library did not pay a ransom. It says that when it became clear no payment would be made, the data was put up for auction and then dumped on the dark web. In November 2023 some personal user information was released. The Library’s buildings stayed open, but research services were severely restricted, and rebuilding its technology began in December 2023.
Timeline
-
February 2020
The Library installs the Terminal Services server for remote access by trusted partners and IT administrators.
-
Late 2022
The Library's information governance group notes the growing risk of managing third-party access.
-
25 October 2023, 23:29
Forensic analysis finds evidence of an external presence on the Library network.
-
26 October 2023, 00:21 to 01:15
The monitoring system blocks suspect activity and the IT Security Manager is alerted; later a password is reset and the account unblocked.
-
28 October 2023, 1:30 am
Jisc sees 440GB of data leave the Library's estate.
-
28 October 2023, 07:35
The intrusion is identified as a major incident.
-
28 October 2023, 09:15
The Crisis Management Plan is invoked; the Gold team meets at 10:00 by WhatsApp video call.
-
28 October 2023, 14:00
NCSC attends a Gold meeting and gives early advice.
-
November 2023
The attackers release some Library data on the dark web.
-
21 November 2023
The Board discusses the specialist advisers' report.
-
December 2023
The rebuild of the infrastructure begins.
-
20 December 2023
The Board approves the Rebuild & Renew program.
-
15 January 2024
A searchable version of the online catalog returns.
-
8 March 2024
The Library publishes its cyber incident review.
-
30 April 2025
The ICO publishes its statement and closes the case without further investigation.
How the attack worked
Getting in
The Library says it cannot be certain of the exact point of entry, because of the damage done and the attackers’ anti-forensic steps. The first detected unauthorized access was at the Terminal Services server, set up in February 2020 for trusted external partners and internal IT administrators. The Library judges the most likely source to be compromise of privileged account credentials, possibly by phishing, spear-phishing or brute force. Access to that server did not need multi-factor authentication, and the Library considers this likely helped the attackers.
Looking around first
On the night of 25 to 26 October an external presence was seen on the network. A monitoring system blocked the activity. The Library now believes this was hostile reconnaissance. Its first review found nothing clearly malicious, and a password was reset.
Copying the data
The Library’s advisers believe the attackers used three methods. First, whole sections of network drives belonging to Finance, Technology and People teams were copied, about 60% of the content. Second, a keyword scan for words such as “passport” or “confidential” copied about 40%, including files in drives staff used for personal purposes. Third, the attackers hijacked native IT tools to create backups of 22 databases and took those out.
Encryption and destruction
The Library describes the Rhysida method as defense evasion and anti-forensics (deleting logs), data exfiltration for ransom, encryption for impact, and destruction of servers to inhibit recovery. A different security product stopped the encryption on laptops and desktops, but older server defenses could not resist it. Server destruction was the most damaging part, because the Library had secure copies of its collections but nowhere to restore them.
Why it spread so far
The Library says its complex legacy network gave the attackers wider access than a modern design would, and that manual data transfers between older systems left more staff and customer data on the network.
- ReconnaissanceOutside presence on 25 October, blocked by monitoring
- EntryLikely stolen privileged credentials on a terminal server with no MFA
- Data theftAbout 600GB copied by wholesale copy, keyword scan and database backups
- Encryption and destructionServers encrypted or destroyed, users locked out on 28 October
- ExtortionNo payment made; data auctioned and dumped on the dark web
Who says who was behind it
Who attributed it, and how firm it is
Attributed by the British Library, 8 March 2024 (its published review): the attack "was claimed by the Rhysida ransomware gang". The review also calls the attackers a criminal gang and says their goal appears to be monetary. It describes methods of "Rhysida and its affiliates".
The former Chief Executive wrote on 8 March 2024 that the motive appears to have been purely monetary.
No government body in the sources opened (ICO, NCSC pages) adds an attribution of its own. The claim is the Library's account of who claimed the attack.
Impact
Data: the Library says about 600GB of files, just under half a million documents, were copied, including personal data of users and staff. Some was released on the dark web in November 2023. It believes no credit card data was taken and that the unedited Electoral Roll database stayed protected.
Systems: much of the server estate was encrypted or destroyed. Major systems, including the main library services platform, cannot return in their pre-attack form. Cloud-based finance and payroll kept working.
Services: premises stayed open and exhibitions and events went on. Research services were severely restricted for the first two months. A searchable catalog returned on 15 January 2024. In the review, Reading Room access to physical collections was limited to about 50% by volume.
Money: the Library said in March 2024 that the net financial cost was still being calculated. It did not pay a ransom.
Audit view: the National Audit Office (January 2025) reports that the directly attributable additional costs totalled £600,000 by March 2024, that the Library told it the overall cost will be many times more, and that its efforts to rebuild digital infrastructure were still ongoing in January 2025. The NAO says the Library assessed that legacy IT systems made the impact more severe.
Government and regulator response
- 28 October 2023: the Library invoked its crisis plan within hours, consulted NCSC, and brought in NCC Group as specialist advisers. NCSC attended a Gold meeting that afternoon. DCMS and the Board were informed.
- The Library told the ICO and other regulators within statutory time frames, and contacted affected users and staff with NCSC advice. It bought credit monitoring and identity protection for staff, some former staff, Board members and users where appropriate.
- It made no payment and did not engage with the attackers.
- 20 December 2023: the Board approved a Rebuild & Renew program to restore services and renew the infrastructure.
- 8 March 2024: the Library published its review with 16 lessons for peers.
- 30 April 2025: the ICO said the Library reported the attack in October 2023, commended its openness, decided further investigation would not be the best use of its resources, and gave the Library guidance.
Lessons
-
MFA must cover every internet-facing door
The Library had MFA for end-user technology but not on certain supplier endpoints. Its own lesson: MFA on all internet-facing endpoints, whatever the technical difficulty. The ICO also pointed to the missing MFA on an administrator account.
-
Treat small intrusion signs as serious
A blocked alert on 26 October was reviewed and a password was reset, but it was later judged to be reconnaissance. The Library advises an in-depth security review after even the smallest signs of intrusion.
-
Third-party access needs tight control
The Library used many trusted partners with varied access, and flagged the growing risk in late 2022 but had not yet acted. It plans stronger privileged access management.
-
Legacy systems make recovery slow
The Library says legacy infrastructure was the main reason recovery takes so long, because old systems cannot be restored or run on modern servers.
-
Backups need somewhere to restore to
The Library had secure copies of collections but no viable infrastructure to restore them onto. It says security spend must be balanced with recovery capability.
-
Segment the network
The Library says no perimeter can be made fully secure and its flat legacy layout let the attack do more damage.
What to check in your own organization
-
Remote access servers
List every server that outside partners or administrators use to log in remotely, and confirm each one requires multi-factor authentication, including on-premises servers.
-
Third-party accounts
Review which suppliers have privileged accounts, how long they last, and whether their access is monitored and time-limited.
-
Small alerts
Check that any blocked or odd login alert leads to a wider review, not only a password reset.
-
Personal and sensitive files
Search network drives for files named like passport or confidential, and for personal use of work storage, since the attackers searched for those words.
-
Backups and rebuild
Confirm you hold offline or immutable copies and that you have somewhere to restore them. Test a full-outage recovery plan, not just single systems.
-
Network layout
Check whether servers can reach each other freely, and whether segmentation would limit an intruder.
-
Legacy and support status
Make a list of systems the vendor no longer supports and a plan to replace them.
Where it happened
Questions
Who attacked the British Library?
The Library says the Rhysida ransomware gang claimed the attack (review of 8 March 2024). The sources opened give no government attribution.
Did the Library pay the ransom?
No. The Library says it made no payment and did not engage with the criminals.
How did the attackers get in?
The Library cannot be certain. The first detected unauthorized access was at a terminal server with no multi-factor authentication. The most likely cause is compromised privileged credentials.
How much data was taken?
The Library says about 600GB of files, just under half a million documents. Some personal data of users and staff was released on the dark web.
Was the Library closed?
No. Premises, exhibitions, events and Reading Rooms stayed open, but many online and research services were restricted.
Did the ICO fine the Library?
The ICO statement of 30 April 2025 says it decided further investigation would not be the most effective use of its resources and gave guidance. It mentions no fine.
Sources
- Learning lessons from the cyber-attack: British Library cyber incident review (PDF, 8 March 2024) British Library
- Learning lessons from the cyber-attack (blog, 8 March 2024) British Library
- Cyber-attack recovery update British Library
- Statement on British Library's 2023 ransomware attack (30 April 2025) Information Commissioner's Office
- Government cyber resilience (HC 546, session 2024-25, 29 January 2025; case study: ransomware attack on the British Library) National Audit Office
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.