Sales: 0845 470 4001 | Support: 0845 230 6001 | Contact Form | NPS
In October 2023, the British Library suffered “one of the worst cyber incidents in British history,” as described by Ciaran Martin, ex-CEO of the National Cyber Security Centre (NCSC).
The notorious Rhysida ransomware gang broke into one of the world’s greatest research libraries, encrypting or destroying much of its data, and exfiltrating 600 GB of files, including personal information of British Library staff and users.
This wasn’t the type of cyber attack that can be easily glossed over. The British Library’s enormous trove of data – with over 170 million items, including 13 million printed and electronic books, plus hundreds of thousands of periodicals, microfilms, and rare manuscripts – is used by researchers around the world.
Visitors to the library – online or in-person – were left in no doubt of the scale of the problem.
Meanwhile, the Rhysida hacking group demanded a ransom of 20 Bitcoin (approximately £600,000 at the time) for decryption keys and the return of the stolen data.
The British Library, however, announced that it had chosen not to have any contact with the Rhysida gang, let alone pay the ransom:
The library has not made any payment to the criminal actors responsible for the attack, nor engaged with them in any way. Ransomware gangs contemplating future attacks such as this on publicly-funded institutions should be aware that the UK’s national policy, articulated by NCSC, is unambiguously clear that no such payments should be made.
The Rhysida hacking group published the stolen data on the dark web after failing to secure the ransom of 20 bitcoin that it had demanded.
The decision as to whether ransomware-hit organisations should pay a ransom or not is a complex one.
In a perfect world, if no-one ever paid the ransom, there wouldn’t be an incentive for ransomware gangs to attack companies. Criminals would look for other ways to make their fortunes, and hacking gangs would simply determine it wasn’t worth launching ransomware attacks.
Unfortunately, the world isn’t perfect. Some organisations will feel that they have no choice but to make the painful difficult decision to pay their attackers. It’s not that paying your extortionists is a good thing to do, but it might well be the pragmatic less worse thing for a business to do if it can see no other way to continue operating.
Five months later, while its buildings have remained open, the British Library’s online systems and services remain profoundly affected. Users cannot even change the passwords they have previously used to access British Library services.
The rebuild of the British Library’s infrastructure is expected to be completed by mid-April. After that, it will begin to restore systems in a phased roll-out.
Now, in an admirable display of transparency, the British Library has published a detailed report into the cyber attack, the lessons it has learnt, and detailed the struggles it has faced renewing its complex legacy infrastructure to better secure itself into the future.
Is your company ready for a ransomware attack?
Many organisations underestimate the importance of having a robust incident response plan. But knowing how to respond, especially in those critical first 48 hours after a cyber attack, can be critical.
Do you worry your company won’t know how to recover after a cyber attack? Has your business just been hit by ransomware and you’re wondering what to do?
There’s still hope.
Don’t make the mistake of believing that your organisation will never be targeted. The right approach is to take proactive measures in advance – as it’s not a case of whether your business will suffer the likes of a ransomware attack but when.
Make sure to read Exponential-e’s step-by-step guide on ransomware remediation.
The experts at Exponential-e are holding an event at The Shangri La Hotel in The Shard, London, on the 2nd May 2024. Register your free attendance now, and learn how you can best prepare your business against the threat of a devastating cyber attack.
Cyber Security Capabilities
Monitoring, management and testing are vital to maintaining a robust cyber security posture.
Read our comprehensive guide to understand how our Cyber Security eco-system can help protect your organisation from the latest cyber threats.
