News
The British Library’s recovery from a devastating ransomware attack that laid waste to its IT systems continues - with hopes that some of its most popular services will be running again in September
By
- Alex Scroxton,Security Editor
Published: 30 Jul 2024 15:36
British Library chief executive Roly Keating has said that the organisation is aiming to have some key services that remain offline after a cyber attack restored in time for the beginning of the new academic year in early September.
The Rhsyida ransomware gang struck the British Library over the weekend of 28-29 October 2023, causing the venerable institution to pull multiple services offline. Data stolen by the Russia-linked cyber criminal cell was subsequently leaked after the British Library rebuffed its extortion attempts.
The British Library received an outpouring of public support following the cyber attack, and under Keating’s stewardship, it has been remarkably transparent when it comes to detailing how the cyber criminals were able to access its systems. This access was likely through a phishing attack against someone with access to a specific server put in place at the beginning of the Covid-19 pandemic to allow external partners and IT support staff to access the network.
“The British Library occupies a special place in the world of research, and for our many users across the UK and international academic community, the past nine months since the cyber attack of October 2023 have been a uniquely frustrating and sometimes upsetting time, as familiar services and resources have remained either limited or, in some cases, inaccessible,” said Keating.
“I can only apologise for the disruption that has been caused to so many of you. It is, I know, of little comfort to say that the sense of loss you feel is shared by every one of us here.”
So destructive was Rhysida’s attack – which directly targeted the British Library’s core infrastructure – that a comprehensive rebuild is still ongoing, something that would take years rather than months under normal circ*mstances.
This process continues today, and as it moves through the Herculean task, the British Library is also scanning its vast number of datasets to ensure Rhysida has not left anything nasty behind. More than six billion files have now been scanned and given a clear bill of health, said Keating,
In the coming weeks, Keating said the British Library’s efforts will turn to the beginning of the new academic year and ensuring that the “best achievable” range of services are stood up in time.
Chief among these services is the return of remote ordering capabilities for Reading Rooms, which British Library users – particularly those for whom a journey to its London or Yorkshire sites are a significant undertaking – had been clamouring for.
The library’s ability to restore this element of its services has been hampered by the lack of a secure compute infrastructure to enable it to track material as it moves from storage to Reading Rooms and back again – note that the British Library does not operate like a local library with shelves of items for users to pick over at leisure.
However, despite this potential roadblock, an interim remote ordering solution is now due to go live by 1 September, buying the British Library time to stand up something more permanent. More details of this workaround are to be made available in the coming weeks, it is understood that some aspects of the process will remain semi-manual, but users should notice a significant difference, said Keating.
Also in scope for September is the restoration of online resources for research and learning. An initial set of some of the British Library’s digitised manuscript collection – which includes unique and precious works, including some of the earliest printed Bibles in English, and works by the likes of Chaucer – will soon be made available, and the organisation’s curators are working on a prioritised list based on the most popular items prior to the cyber attack.
Keating said the British Library would continue work on this project to gradually increase the number of items available online, although it will not be possible to restore the digitised manuscripts website as it was.
At the same time, “selected resources” from the British Library’s learning websites will also begin to reappear on the web, including the most-viewed items from the Discovering Literature web resource, such as the works of Jane Austen, William Blake, the Brontë sisters, Charles Dickens, Thomas Hardy and Oscar Wilde.
More good news
Additionally, said Keating, a new solution has now been implemented to restore access to Non-Print Legal Deposit (NPLD) content to the British Library’s legal deposit partners, the National Libraries of Scotland and Wales, Cambridge University Library, the Bodleian Libraries at the University of Oxford, and the library of Trinity College Dublin in Ireland.
This will give readers at each of these institutions access to digitised versions of e-journals and e-publications made prior to the cyber attack, but not yet the UK Web Archive. Access to NPLD content from within the British Library itself will require a different solution and should follow soon.
Finally, work to restore access to the British Library’s Automated Storage Building (ASB) and the National Newspaper Building (NNB) at its Yorkshire base in Boston Spa are now nearing completion. This will see items held on nearly 262 kilometres of shelving made available to Reading Rooms once again – ASB content will return in August, and a timetable for NNB content is still being established.
“The service restorations described … are just the next stage in a continuing process: looking further ahead, we will continue to increase the range and scale of the materials available, while also looking to lay the foundations of a comprehensive longer-term service offering, including a full-scale website and a brand-new library services platform,” said Keating.
“I would like to thank all of our users across the academic community and beyond for the patience and understanding you have shown us on our journey so far along the complex and sometimes bumpy road to recovery from the cyber attack. We are working hard to deliver both the access that you require, and the secure and resilient service you deserve.”
Computer Weekly coverage of the British Library cyber attack
- 31 October 2023:The British Library is experiencing a major IT outagefollowing a cyber incident of an undisclosed nature.
- 16 November:The British Library has provided an update on an ongoing cyber incident affecting its systems,confirming it to be the result of a ransomware attack.
- 21 November:Ransomware group Rhysida threatens to sell documents stolen from the British Libraryto the highest bidder.
- 28 November:Personal data on British Library users has appeared for sale on the dark web following a Rhysida ransomware attack,as the scope of the still-developing incident widens again.
- 30 November:The Rhysida ransomware gang behind the cyber attack on the British Library has published almost 600GB of stolen datato its dark web leak site.
- 7 January 2024:The cost of recovering the British Library’s ransomware-stricken IT systems could be up to £7m,it has emerged.
- 15 January: The British Library has restored online access to its main catalogue of nearly 40 million items on a limited basis as it continues the long and arduous process of recovering from a ransomware attack.
- 13 March: The British Library has opted for full transparency after experiencing a devastating ransomware attack, publishing details of the intrusion, its response and the lessons it has learned.
Read more on Data breach incident management and recovery
- British Library opens up over ransomware attack to help othersBy: AlexScroxton
Lurie Children’s Restores Key Systems Following Cyberattack
By: JillMcKeon
- Leak of 26 billion records may prove to be ‘mother of all breaches’By: AlexScroxton
- British Library catalogues back online after ransomware attackBy: AlexScroxton
