British Library cyber incident review [pdf]

I happened to be there while this attack was in progress (ocotober 23). And all there systems were really offline, POS didnt work, wifi didn’t work, literally anything connected to a computer didnt work.

What’s unfortunate is that they flagged this vulnerability in 2022 and planned to review it in 2024 ???

Does it usually take this long to identify impact of users? They mentioned they paid for identity protection for their staff & ex-staff as well.

Good report. Well written incident summary useful for cyber-students to follow and learn.

> The Library utilises numerous trusted partners for software development, IT maintenance, and other forms of consultancy

> increasing complexity of managing their access was flagged as a risk.

> first detected unauthorised access to our network was identified at the Terminal Services server. This terminal server had been installed in February 2020 to facilitate efficient access for trusted external partners

Sadly their response seems to be using more cloud infrastructure and outsourcing more.

trusted != trustworthy

The essential lesson - that good IT and security people within your company cost money. It is worth paying for vigilance, loyalty and care - has not been heeded.

I work in a related field (cyber insurance response) - typically takes a few months to identify exfiltrated data and then analyse it to understand what is in it. This might seem simple but there are usually in the region of hundreds of thousands to millions of files, and that may contain spreadsheets with tens of thousands of rows. This all has to be analysed, filtered and reduced to the point you have a list of PII which has been impacted, and can decide on what to do.

Credit monitoring is usually offered as standard when a breach occurs, the UK is much less litigation friendly than the US so in the absence of any actual harm, that would discharge most of their obligations to protect you following an incident.

This report is a joke.

No root cause. On other forums it is understood they were running very old and unpatched VMware os. Which is simply embarrassing and everybody within their IT team should be fired immediately for gross negligence.

They can't inform people whos data has been compromised because they refuse to pay the ransom and have no other way to tell what was stolen. Farcical.

Their ability to rebuild in a timely manner was hampered by not having any spare servers and presumably because all their server hardware was compromised and couldnt be used for restore.

I object to the word "utilises" instead of just plain "uses", especially from a library.