INCIDENT REPORT · CP-2023-004
British Library ransomware attack
L3 · ELEVATEDCONFIRMED
The British Library suffered a ransomware attack identified on 28 October 2023. Data was exfiltrated and much of its server estate was encrypted or destroyed.
- Incident ID
- CP-2023-004
- Incident date
- 28 OCT 2023
- Detection date
- 28 OCT 2023
- Affected countries
- United Kingdom
- Plotted location
- London, United Kingdom (Affected organization headquarters)
- Threat classification
- Level 3 — ELEVATED
- Classification rationale
- Prolonged outage at a major national cultural and research institution.
- Attack type
- Ransomware
- Nature
- Malicious activity
- Attack vector
- Most likely via a remote access (Terminal Services) server not protected by multi-factor authentication, possibly using compromised third-party credentials (per the Library's review)
- Sectors
- Education, Government
- Critical infrastructure
- No
- Organizations affected
- British Library
- Operational consequences
- All users were locked out of the network and many core services, including the online catalogue, stayed disrupted for months. About 600 GB of stolen data was reportedly leaked.
- Estimated financial impact
- No reliably documented figure
- Attribution (as stated)
- Attributed by the British Library (cyber incident review) to the Rhysida ransomware group
SOURCE REFERENCES
- [1] Learning lessons from the cyber-attack: British Library cyber incident reviewBritish Library · bl.uk · 08 MAR 2024
- [2] Third-Party Breach and Missing MFA Contributed to British Library Cyber-AttackInfosecurity Magazine · infosecurity-magazine.com
RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.