A ransomware attack by the Rhysida gang in October 2023 crippled the British Library for months, knocking its catalogue, website and reader services offline and leaking staff data on the dark web. The institution's refusal to pay became a landmark stand against cyber extortion.
On 28 October 2023, the Library told followers it was experiencing technical issues affecting its website. By the 31st it confirmed the outage was the result of a cyberattack, and on 16 November it acknowledged it was dealing with ransomware. The attackers were Rhysida, a ransomware-as-a-service operation first observed in May 2023 that had already been flagged by the FBI and America's CISA for targeting organisations across education, healthcare and government.
Rhysida's methods were textbook double extortion. On 20 November the gang claimed responsibility and put 490,191 stolen files up for auction on its dark web leak site, opening bidding at 20 bitcoin, then worth around £600,000, and advertising the haul as exclusive, unique and impressive. Sample images appeared to show HR documents, employment contracts, passport scans and HM Revenue and Customs paperwork. The Library admitted the leaked data appeared to come from its internal human resources files.
When the auction deadline passed with no buyer, Rhysida dumped around 600GB of data, some 90 per cent of what it had stolen, free for anyone to download. The Library, following UK government guidance and law-enforcement advice, refused to pay the ransom.
The cost of defiance was enormous. The Library's online catalogue, digital collections, staff email, reader registration and card payments were knocked out for months. Its grand St Pancras reading rooms operated in what The New Yorker called a 'pre-digital state', with staff reverting to paper slips and manual processes. The Financial Times reported the recovery would consume around 40 per cent of the institution's financial reserves, an estimated £6 to £7 million.
In March 2024, the Library published a candid report into the breach. The most likely source, it said, was compromised credentials belonging to a third-party IT supplier, exploited through a Terminal Services server installed during the Covid pandemic, combined with the absence of multi-factor authentication despite previous internal warnings about the risk. The increasing use of third-party providers with privileged network access had been flagged as a danger in late 2022, but the planned security review had not been completed before the attack.
Rhysida went on to strike again in Britain, hitting the private King Edward VII's Hospital in London and claiming to have stolen data relating to the royal family. For the British Library, an institution entrusted with safeguarding centuries of human knowledge, the attack was a humbling lesson: in the digital age, even the guardians of the past can be brought to their knees by criminals they will never see.