Photo by Albert Stoynov on Unsplash
October 2023. The British Library - one of the most significant cultural institutions in the world - had its digital infrastructure brought to a standstill by a ransomware group. For months, staff could not access internal systems, public-facing digital services went dark, and sensitive HR records were eventually published online after the Library declined to pay a ransom. If you run or manage a museum, gallery, or archive in the UK and your first reaction was 'we are nothing like the British Library in scale' - that instinct is exactly the problem. Ransomware groups are not looking for the biggest target. They are looking for the most accessible one.
What the Attackers Actually Did
The Rhysida ransomware group did not breach the British Library through some extraordinary technical exploit. They got in through a remote management server using an account that had no multi-factor authentication in place. A third-party account, connecting via a remote access service, with no second layer of verification required. Once inside, the attackers moved laterally through the network. Systems that should have been isolated from each other were connected, and legacy infrastructure gave the attackers room to move. By the time the full extent of the attack was understood, approximately 490,000 files totalling 573 gigabytes of data had been encrypted, including some HR records. The Library declined to pay the ransom demand. The attackers published the data anyway. Digital services took months to restore.
Why Cultural Institutions Are on the Radar
Museums, galleries, and archives hold data that matters - staff records, donor information, visitor databases, collections documentation - often spread across a mix of older and newer systems that were not designed with modern security in mind. Ticketing platforms, collection management software, public Wi-Fi networks, and point-of-sale terminals all sit on the same estate, frequently managed by small IT teams carrying a long list of competing priorities alongside a constrained budget.
Add remote access into that picture - for staff working off-site, for contractors, for collections consultants and visiting researchers - and the attack surface grows considerably. Many of those accounts are set up for convenience rather than security. That combination is exactly what ransomware groups look for when they are choosing their next target.
Three Failures That Opened the Door
No Multi-Factor Authentication on a Remote Access Account
The British Library breach began at a single account on a remote-access server. That account had no second verification step. A code sent to a phone, or an authentication app prompt, would have blocked the attacker at that point regardless of whether they had the password. Controlling who can access your systems and how is not a complex or expensive discipline - and multi-factor authentication is one of the five core technical requirements of Cyber Essentials, the UK government-backed certification that is increasingly a condition of accessing public sector grants and certain funding streams for cultural organisations.
A Network With Too Little Separation
Once inside, the attackers moved from system to system. In a network with proper segmentation, a compromised account in one area does not automatically have a path to everything else. Visitor-facing systems, administrative infrastructure, and back-end databases should sit in distinct zones with controlled access between them. The Library's architecture allowed lateral movement that should not have been possible, and the damage spread accordingly. For a museum or gallery with a mix of public-facing and internal systems, that separation is not a luxury - it is what limits the blast radius when something goes wrong.
Legacy Systems Running Alongside Modern Infrastructure
Older systems sitting on the same network as modern ones create gaps that are hard to close. Security patches may no longer be available for software that is out of support. Endpoint protection tools may not be compatible with ageing operating systems. The longer that legacy infrastructure runs unaddressed, the wider the gap between what a network diagram shows and what is actually exposed. This is a common reality in cultural institutions, where decades of technology investment sit in layers rather than clean, well-documented generations.
What Good Looks Like in Practice
The controls that would have stopped - or significantly limited - the British Library attack are not exotic. They are the fundamentals, applied consistently across the whole organisation, including accounts belonging to third parties:
- Multi-factor authentication on every account with remote access, without exception
- Network segmentation that limits what any single compromised account can reach
- A current inventory of every device on the network, with a clear plan for patching or decommissioning anything that cannot be properly secured
- Tested, isolated backups that ransomware cannot reach and encrypt through the same credentials used on your main systems
That last point deserves more than a bullet point.
Why Having Backups Is Not the Same as Being Protected
Most organisations have some form of backup in place. Ransomware groups know this. Modern ransomware often targets backup systems before encrypting everything else, looking for connected backup drives or cloud repositories that share the same login credentials as the systems under attack. A backup that ransomware can reach and encrypt is not a safety net - it becomes part of the collateral damage. Backups that are genuinely useful after a ransomware attack are immutable, held separately from the main network, and tested regularly to confirm that restoration actually works under real conditions, not just in theory.
A Practical Starting Point
If you are responsible for IT at a UK museum, gallery, or archive and you are not certain whether these controls are properly in place, that uncertainty is itself the answer. A structured security assessment gives you an evidence-based picture of where you stand. Working toward Cyber Essentials certification gives you a tested baseline across access control, software patching, malware protection, network boundaries, and device configuration - the same areas that the British Library attack exploited, and the same areas that auditors, funders, and insurers are increasingly asking about.
You can find out more about how CyberStark supports cyber security for museums and galleries, or get in touch to talk through what a sensible starting point looks like for your organisation.