Ransomware Shuts Down Wi-Fi and Computers at Queens Public Library
Queens Public Library says ransomware encrypted its systems, knocking out public computers, self-checkout, Wi-Fi, digital media and its app across 66 branches. No gang has claimed it yet.
Ransomware has knocked out much of the Queens Public Library’s digital side: public computers, self-checkout and return machines, Wi-Fi, digital media and the mobile app are all down. The Record reports that the New York City system, with 66 branches serving the borough’s 2.3 million residents, confirmed in several alerts on Wednesday that a ransomware attack was behind the outage. All locations are still open on their normal schedule, though some programs may be affected.
For defenders
What’s confirmed: the library says a ransomware attack encrypted its systems (T1486 (Data Encrypted for Impact)) and that it’s working with law enforcement and outside cybersecurity experts. How the attackers got in, when the intrusion started, and whether any patron or staff data was copied out are not disclosed. As of Thursday evening no ransomware gang had claimed the attack, per The Record, and New York City officials didn’t answer its questions.
Why libraries keep getting hit: they run a lot of public-facing services on thin IT budgets, and they hold records on large parts of the local population. The Record points to the Seattle Public Library outage and the Pierce County Library System attack in Washington, which exposed data on more than 340,000 people. Data theft before encryption is the usual pattern for today’s crews, so the absence of a leak claim so far proves nothing either way.
For other public-sector IT teams: the services that fell over here (patron PCs, kiosks, Wi-Fi, the app) usually share an identity system and a management network with staff systems. Separating public-facing machines from back-office systems and keeping offline backups of the catalog and patron databases is what turns an attack like this into days of disruption instead of weeks.
What it means for you
If you use the Queens Public Library, you can still visit and borrow in person, but expect the computers, Wi-Fi, e-books and the app to be unavailable for a while. Nothing has been said yet about patron data. If the library later says records were taken, the likely risk is phishing that uses your library account details to look convincing.
Do this now
- Check the library’s official website or social accounts for updates instead of clicking links in emails or texts about your account.
- If you reused your library account password anywhere else, change it there now.
- Be wary of messages about “overdue fines” or “account verification” from the library until it confirms its systems are back.