Open book: the british library hack

Since the 17th century, the British Library and its predecessor institutions have been home to one of the most important collections of documents, books and periodicals in the world. Today, it’s our national deposit library, and publishers have a legal obligation to file a copy of every new book published with the library. As such, it’s a hugely important research institution, and the corridors and research rooms on any given day are usually packed with academics and scholars.

At least, that’s what should be happening.

On the last weekend of October last year, disaster struck the library as a ransomware attack quietly spread across its systems, locking out researchers, staff and management alike. The hackers demanded payment to unlock the system, simultaneously threatening to release the personal data of many of the library’s users if the institution didn’t pay up.

“The people responsible for this cyberattack stand against everything that libraries represent: openness, empowerment, and access to knowledge,” wrote British Library chief executive Sir Roly Keating in a blog post following the attack. (The British Library declined to speak to us directly.)

According to Keating, when the attack was spotted, action was quickly taken to lock down and isolate the library’s network, but “significant damage was already done”. He also notes that a staggering 600GB cache of data stolen from the library had already made its way onto the dark web, where the attackers were auctioning off the data to the highest bidder.

The damage to operations has also been severe. The Reading Rooms where researchers go to view documents have been unable to retrieve items from the library’s vast collection, and digital services including a database of 600,000 doctoral theses have been rendered unavailable.

At the time of writing, almost four months after the attack, the recovery is still likely to take further “months”, according to the Library. “The Library itself remains a crime scene,” according to Keating.

All of which begs the question: how was a major British institution taken down so easily?

A basic attack

A hacking group called Rhysida, seemingly named after a species of centipede, claimed responsibility for the attack shortly after it occurred. The various security analysts we��