Queens Public Library Confirms Ransomware Attack

Queens Public Library in New York City confirmed on Wednesday that a ransomware gang encrypted its systems, according to The Record. No group had claimed the attack as of Thursday evening.

What is down

The library said on-site computers, check-out and return machines, Wi-Fi, digital media services and its mobile app are offline. All 66 branches remain open as scheduled, though some virtual and in-person programs may be affected. The library first warned of outages Wednesday afternoon and confirmed ransomware hours later. It says it is working with law enforcement and cybersecurity experts.

New York City officials did not respond to The Record’s requests for comment. The library system serves the borough’s 2.3 million residents and also runs learning centers in public housing complexes and several mobile libraries.

Why it matters

Library systems hold a lot of local resident data, and this is not a new target class. The Record points to an attack last year on Washington State’s Pierce County Library System that exposed information on more than 340,000 people, plus earlier incidents at Seattle Public Library, the British Library and Toronto Public Library. The Record notes that gangs lean on public demand for e-books and essential services as pressure to pay.

No data theft has been confirmed in this case. Treat that as unknown, not as cleared.

What to do

• Patrons: If you have a library account, watch for phishing that references the outage, and change the password if you reused it elsewhere. Use only the library’s official channels for updates.
• Other library and municipal IT teams: Check that backups are offline and restorable, and that guest Wi-Fi and public-use computers are segmented from staff and records systems. Public-facing services are the part patrons notice first, so decide in advance what degraded operation looks like.

Related coverage: ransomware hub.