British Library Says Staff Data Stolen In Ransomware Attack
British Library confirms weeks-long outage due to ransomware attack as Rhysida group begins auction for stolen staff data
The British Library has confirmed staff data was compromised in a ransomware attack that took place at the end of last month.
The institution, one of the world’s biggest document repositories, disclosed this week week that technical issues it has been experiencing since the end of October were due to a ransomware attack.
The library has now added that data on staff appears to have been stolen. The data is being auctioned by the attack group Rhysida this week, according to a dark web post by the group.
The damage caused by the Rhysida ransomware has led to the library’s main website being down for nearly a month and has also affected online systems and services such as book ordering.
Stolen data
The hacking group on Monday claimed responsibility for the attack and released low-resolution images of what appeared to be British Library employees’ passports.
It opened opened bidding for an undisclosed set of documents for 20 bitcoin, or roughly £587,000.
“Following confirmation last week that this was a ransomware attack, we’re aware that some data has been leaked. This appears to be from our internal HR files,” the British Library said on X, formerly Twitter.
It said there was “no evidence” of user data being compromised and has not confirmed the data being auctioned belongs to its employees.
The library said it “anticipates restoring many services in the next few weeks, but some disruption may persist for longer”.
Public bodies
US intelligence services said this month they became aware of Rhysida in May.
The group, which typically targets public bodies such as schools, hospitals and government agencies, is linked to Vice Society, which has connections to Russia and became known for targeting US healthcare facilities during the Covid-19 pandemic.
The National Cyber Security Centre (NCSC) last week warned of a heightened threat to critical IT infrastructure after an increase in cyber attacks by organisations sympathetic to Russia’s invasion of Ukraine.
