The Unhinged Librarian
11 min read

U.S. Libraries Under Siege: The Ransomware Attacks You Haven't Heard About

American libraries are getting hit with ransomware attacks, and most fly under the radar. From Baker & Taylor to Seattle Public Library, here's what's actually happening and what your library should do about it.

TL;DR
  • U.S. library ransomware attacks are systematic and underreported: Baker & Taylor (17-day outage), Seattle Public ($1M recovery cost), and targeted attacks on academic institutions.
  • Ransomware impacts extend beyond direct attacks, vendor compromises cascade to thousands of dependent libraries with no warning.
  • Recovery costs are staggering: forensic investigation, ransom negotiation, system restoration, and ongoing security improvements can exceed $1M.
  • Multi-factor authentication (MFA) works: Library of Congress blocked a Rhysida attack using MFA, preventing breach. MFA should be mandatory organization-wide.

While the world was paying attention to the British Library and Toronto Public Library ransomware attacks in late 2023, American libraries were getting hit too.

You probably didn't hear about most of them. Some made local news. A few got brief mentions in library trade publications. But most flew under the radar.

That's a problem. Because what's happening to U.S. libraries right now is a systematic, accelerating pattern of attacks. And most libraries still think "it won't happen to us."

Let me show you what's actually happening.

Baker & Taylor: When Your Vendor Gets Hit, You Get Hit

August 20-21, 2022: Baker & Taylor, one of the largest book distributors serving over 5,000 public and academic libraries across North America, was hit with a ransomware attack over the weekend.

The attack took down:

For 17 days, thousands of libraries couldn't order books.

Think about that. Not a direct attack on libraries. An attack on their critical vendor. But the impact? Thousands of libraries disrupted simultaneously.

Baker & Taylor took systems offline proactively to contain the attack. Their IT team and outside consultants worked around the clock. By August 30, they'd finished remediating and sanitizing systems. By September 7, Title Source 360 was back online.

Total outage: 17 days.

Ransomware group: Never publicly identified.

Ransom payment: Baker & Taylor never disclosed whether they paid.

Board asking about security funding?

You might think: "We don't control our vendor's security. What can we do?"

Here's what you can do:

  1. Ask vendors about their cybersecurity practices before signing contracts
  2. Require vendors to notify you within 24 hours of a breach
  3. Have backup vendors identified for critical services
  4. Include cyber incident response clauses in contracts

Because when your vendor goes down, your library goes down. And you don't get to choose the timing.

Seattle Public Library: $1 Million to Recover

May 2024: Seattle Public Library's systems were hit with ransomware. All 27 locations were affected.

What went offline:

Unlike some libraries that tried to downplay the impact, Seattle was transparent about the costs:

Consultant fees: ~$800,000

Extra IT costs: ~$200,000

Total projected cost by year-end: $1 million

And that's just the direct response costs. It doesn't include:

What Seattle Did Right

Seattle hired forensic investigators immediately. They brought in ransom negotiators (even though they ultimately didn't pay). They restored systems methodically instead of rushing.

But here's the thing: They had to spend $1 million to do it right.

Most libraries don't have a million-dollar incident response budget sitting around. Seattle is a major urban system with resources. What happens when a small rural library system gets hit?

Library of Congress: The Attack That Didn't Succeed

October 28, 2023 (the same day as British Library and Toronto): The Library of Congress was targeted by a cyberattack, likely by the same Rhysida group that hit the British Library.

The attack failed.

Why? Multi-factor authentication.

The hackers tried to get in through the same type of entry point that worked at the British Library: remote access credentials. But LOC had MFA enabled on that system.

The hackers couldn't get past the second authentication factor. Attack blocked.

The $0 Incident

Library of Congress's costs:

This is the story every library should be telling. MFA works. It's not perfect, but it stops the vast majority of credential-based attacks.

And credential compromise is how most ransomware attacks start.

Pierce County Library System: The Attack Nobody Talked About

Timeframe: Undisclosed (reported in 2024)

Pierce County Library System in Washington State confirmed they were hacked and information was stolen.

Details about the attack? Minimal public disclosure.

What we know:

What we don't know:

The Problem with Silence

I understand why libraries don't want to talk about breaches. Negative publicity. Patron concern. Legal liability.

But the silence is making things worse.

When libraries don't share information about attacks, other libraries don't learn. They don't know what to look for. They don't know what works and what doesn't. They don't know how bad it can get.

The British Library published a detailed incident review. Toronto released cybersecurity reports. Seattle was transparent about costs.

That transparency helps other libraries prepare. Silence just leaves everyone vulnerable.

The Broader Pattern: Why Libraries Are Targets

Let's zoom out. Why are ransomware groups targeting libraries?

1. Libraries Are Soft Targets

Most libraries:

Ransomware groups know this. They're not going after hardened targets when there are thousands of under-defended libraries.

2. Libraries Provide Critical Public Services

Ransomware works because victims need their systems back now. Hospitals can't operate without patient records. Schools can't function without student data. Governments can't deliver services without their databases.

Libraries provide internet access for job seekers. Computer access for students. Research resources for the community. Book checkout for families.

When those services go offline, there's public pressure to restore them quickly. And that pressure creates willingness to pay ransoms.

3. Libraries Have Valuable Data

Patron records. Employee information. Financial data. Donor records. Vendor contracts. Research materials. Historical archives.

All of it has value, either for direct exploitation (identity theft) or as leverage for ransoms.

4. Libraries Are Connected to Bigger Networks

Public libraries are often connected to municipal networks. Academic libraries connect to university systems. Regional library consortia share infrastructure.

Compromise one library, and you might get access to city government systems, university research data, or dozens of other libraries.

Libraries aren't islands. They're entry points.

5. Ransomware Is Now Ransomware-as-a-Service

This isn't lone hackers anymore. Ransomware is a business model.

Groups like Rhysida, Black Basta, LockBit, and dozens of others operate like software companies:

This industrialization means:

And libraries fit the target profile perfectly.

What We're Not Tracking (But Should Be)

Here's what bothers me: We don't have comprehensive data on library cyberattacks in the U.S.

We know about:

But how many more happened that didn't make the news? How many small library systems got hit and quietly paid ransoms or recovered without public disclosure?

We don't know. And that's a problem.

The American Library Association doesn't maintain a public database of library cyber incidents. State library agencies don't track it comprehensively. There's no central reporting mechanism.

Which means libraries are fighting this threat blind, without good data on:

We need better information sharing. Yesterday.

What Your Library Should Do This Week

I'm not going to sugarcoat this: Most U.S. libraries are not prepared for a ransomware attack.

But you can start getting prepared today.

Immediate Actions (Do These This Week):

1. Enable MFA on everything
Every system. Every user. Every vendor connection. No exceptions.

2. Test your backups
Not "Do we have backups?" but "Can we actually restore from them?" Test a full restore.

3. Inventory third-party access
List every vendor, contractor, or service that has network access. Then audit their security.

4. Review your cyber insurance
Do you have it? Does it cover ransomware? What are the limits? What's excluded?

5. Create a communication plan
If your systems go down tomorrow, who communicates with patrons? Staff? The board? The press? Law enforcement?

Write it down. Now. Before you need it.

Short-Term Actions (Next 30 Days):

6. Run a tabletop exercise
Gather key staff and walk through a ransomware scenario. "It's Monday morning. Our systems are encrypted. What do we do?" Identify gaps.

7. Harden COVID-era systems
Any remote access, VPN, or cloud system set up during 2020-2021 needs a security review. Assume they're vulnerable until proven otherwise.

8. Identify incident response partners
Research and vet forensic investigation firms, cyber insurance claims specialists, and legal counsel before you need them. In a crisis, you don't have time to comparison shop.

9. Train staff on phishing
Run simulated phishing exercises. Most ransomware starts with a phishing email. Train staff to recognize and report suspicious messages.

10. Review vendor contracts
Add cybersecurity requirements to all vendor contracts:

Long-Term Actions (Next 6-12 Months):

11. Budget for cybersecurity
Stop treating security as an afterthought. Library boards and funders need to understand: Cybersecurity is not optional. It's infrastructure.

12. Join information-sharing networks
Connect with library cybersecurity groups like LITA's Security Interest Group. Share information. Learn from others' incidents.

13. Develop manual fallback procedures
Toronto kept 100 branches open without digital systems for 4 months. Can you do that? Document manual processes for circulation, reference, programming, and operations.

The Question Nobody Wants to Ask

Here it is: Should libraries pay ransoms?

The official answer, from the FBI, from cybersecurity experts, from law enforcement, is no. Paying ransoms:

The British Library didn't pay. Toronto Public Library didn't pay. Seattle Public Library didn't pay.

But some libraries have paid. We know this because ransomware groups publish statistics (they're businesses, remember). And they count libraries among their paying customers.

So what should you do if you get hit?

My answer: Make that decision now, before an attack, with clear criteria.

Decide:

Document it. Get board approval. Make it policy.

Because if you wait until you're staring at encrypted systems and a ransom demand on your screen, you won't make a good decision. You'll make a panicked one.

This Isn't Going Away

Here's what we know about the trend: Ransomware attacks on the education sector (which includes libraries) have surged dramatically. While comprehensive library-specific statistics aren't available due to lack of central reporting, cybersecurity firms like Emsisoft and Recorded Future document significant increases:

We don't have precise library-specific statistics because there's no mandatory reporting mechanism. Many smaller library breaches never make the news. But the documented cases (Baker & Taylor, British Library, Toronto, Seattle, Pierce County) represent just the tip of the iceberg.

And 2025 showed no signs of slowing down. If anything, attacks are accelerating.

The British Library and Toronto attacks were wake-up calls. But most libraries hit the snooze button.

Don't be one of them.

Further Reading:

Need help building a ransomware response plan for your library? Contact me.

Filed under: Cybersecurity, Ransomware, Library Security

Want updates (or backup)?

Get new posts by email, or book a free 30-minute call if you’re facing a contract, AI policy, or vendor decision.

Get the newsletter Free 30-min call