British Library falls victim to cyber attack

The British Library has disclosed that it has experienced a cyber attack of an undisclosed nature, that has caused multiple technology systems at the institution to go down.

The organisation first confirmed there was an ongoing IT outage via its X (Twitter) account at 5:40pm on Sunday 29 October, but it has taken a couple of days to establish that there is a cyber dimension to its plight.

“We’re experiencing a major technology outage as a result of a cyber incident,” a spokesperson said via X. “This is affecting our website, online systems and services, and some onsite services including public Wi-Fi. We’re currently investigating the incident with @NCSC and other specialists. We know that you may have questions, but please bear with us while we gather more information. We’ll update as regularly as we can.”

At the time of writing, the British Library’s website remains offline, but Computer Weekly understands the library’s facilities in London and Yorkshire remain open, with reading rooms for personal study still available, as well as collections for orders made prior to 26 October. A manual collection item ordering service via its printed catalogues is also available at its London site, although this is limited in its scope.

A cyber incident of this nature will inevitably draw speculation that the British Library has been hit by ransomware, although at the time of writing, this is entirely unconfirmed. Citing sources familiar with the situation, The Register earlier reported that the incident may stem from issues on the library’s VMware ESXi virtual machine (VM) infrastructure.

Given their widespread popularity in enterprise cloud environments, the VMware ESXi family is known to be a growing vector for ransomware infections, and most extant crews have now developed encryptors targeting the platform.

Back in February 2023, a widespread campaign of attacks dubbed ESXiArgs exploited a two-year-old heap buffer overflow flaw in the platform, apparently using a variant of the Babuk ransomware locker. Others are thought to have taken advantage of the Log4Shell vulnerability to conduct their attacks.