In October 2023, the Rhysida ransomware-as-a-service group breached the British Library’s information systems and demanded 20 bitcoin, worth approximately £596,000 at the time. After the Library refused to pay, the attackers published about 600GB of stolen material, reportedly including personal information belonging to Library users and staff. Rhysida also destroyed servers, obstructing recovery and forensic investigation. The incident severely disrupted the United Kingdom’s largest library and was described as one of the country’s worst cyber incidents.
The Library’s systems had firewalls and antivirus protection, but its 2020 pandemic-era MFA rollout excluded domain connectivity, machine logins, and on-premises servers because of cost, practicality, and the impact on ongoing programs. Investigators said the attackers probably exploited phishing, spear-phishing, brute force, or compromised third-party credentials, with contractors also lacking comprehensive MFA. The Library’s Cyber Essentials Plus accreditation from 2019 no longer met revised standards introduced in 2022. Its main catalogue returned in read-only form on 15 January 2024, while other services remained impaired for months and the full financial cost was still being calculated.
