Boston Public Library Suffers a Cyberattack

Bleeping Computer disclosed that on Wednesday, the Boston Public Library was hit by a widespread cyberattack that crippled its entire network.

What Happened?

The Boston Public Library (BPL) serves 4 million visitors per year across twenty-five neighborhood branches and millions online, and it suffered a major cyberattack recently. The library divulged this information last Wednesday in a public statement to the press.

According to Bleeping Computer “It is the third-largest public library in the United States behind the federal Library of Congress and the New York Public Library, based on the  total number of items it holds.”

In the public notice, the library said,

“The library is currently experiencing a significant system outage, and online library services that require login are unavailable.”

“We apologize for any inconvenience this outage may have caused patrons,” said Kurt Mansperger, Chief Technology Officer of the BPL. “Thank you for your patience as our team and law enforcement officials work to restore our digital services and protect the library from future attacks.”

The library uses the OverDrive system for renting content, and currently, all logins are suspended. They hope to have the issue resolved quickly to allow patrons to resume logging into the library services.

How Did the Boston Public Library Respond?

The BPL said as soon as the cyberattack was discovered, all “Affected systems were taken offline immediately, and proactive steps were taken to isolate the problem and shut down network communication.”

As of today, the library is still suffering some outages. They are working closely with government officials and law enforcement. In their public statement, the library commented that, “The library is working with the Mayor’s Department of Innovation and Technology and law enforcement officials to address the cybersecurity attack. The Library’s IT department is working on restoring all technology services. In the meantime, all locations will remain open, patrons will still be able to check out books, and some online services remain operational. This is an ongoing situation, and the library will update patrons and staff about services and impacts on its website.”

So far, law enforcement and threat assessors have not determined who was responsible for the attack, and they can find no evidence that any employee or customer data was exfiltrated.

IT Staff Working Overtime to Fix the Outage

The Boston Public Library’s IT staff is working overtime to fix all the outages caused by the attack. In addition, they are securing any vulnerabilities before bringing services back online.

The library remains open, and customers can still borrow books. However, everything is being handled manually until the system is restored.

The original news of the attack came from a short tweet posted by the BPL last week. Subsequently, they posted a longer statement to inform the public about what was going on.

Bleeping Computer reached out to the Boston Public Library for comment, but a spokesperson was not available.

The State of IT Security and Public Resources

As the news grinds out every day, we see more and more public offices and resources hit by cyberattacks. It hammers home the sad realization that typical cybersecurity measures are not working and that most public resources and government entities are simply not secured well enough. Installing antivirus software on each terminal is not going to cut it.

Most data breaches have occurred due to phishing campaigns and ignorant employees not trained in cybersecurity best practices. IT staff and resources are rarely prioritized until an attack occurs. Despite the U.S. government’s attempts to further nationwide awareness and security-conscious mandates, most organizations don’t act until they have to when it’s already too late.

We, as consumers, are the actual victims because we use these resources and trust these companies with our personal information.