Queens Public Library under ransomware attack | Hacker News Reader

Queens Public Library under ransomware attack

connect.queenslibrary.org

201 pointsrustyhancock112 comments

This happened in seattle a few years ago. Computer systems were down for months. They just let everyone borrow using an honor system.

same for Toronto: https://www.cbc.ca/news/canada/toronto/toronto-library-ranso...

Same for the city of Westmount (Montréal island) a few years back (including the library):

https://globalnews.ca/news/9296036/city-of-westmount-target-...

and the British Library, an attack that took years of recovery which is still not complete

https://en.wikipedia.org/wiki/British_Library_cyberattack

Calgary too:

https://globalnews.ca/news/10812458/calgary-public-library-b...

Hamilton, '24

https://www.cbc.ca/news/canada/hamilton/library-cyber-impact...

TIL. Good job TPL for not paying.

https://spotlightdelaware.org/2024/09/23/delaware-libraries-...

This happened to my state's library system a while back. Public computers and free wifi were down for a few months, but no major disruptions of lending services. I don't think the state paid any ransom, instead they just repaired their systems.

I’m seeing a disturbing trend. People doing things and not expecting consequences. The kind of people that would ransomware a library and the other day a food kitchen. Even if the law doesn’t catch up, karma will. Just ain’t right.

Honestly, if someone unplugs their network and wipes all their disks and gives them free servers and sets it up properly I think that’s the move.

But this isn’t a thing.

For this or the food bank the penalty legally should be the highest.

Despicable to target a place that supports learning and shares public knowledge.

That seems a pretty terrible target for ransomware, it's not like public libraries have huge amounts of money.

Immoral criminals? Now I've seen everything.

The point is that there are surely targets that are better funded and thus more likely to pay out large sums of money in order to fix things.

Definitely, but ransomware groups generally have incremental customer acquisition costs/margins that most other industries can only dream of. They'll encrypt first, ask questions/set prices later. The whole process might even be fully automated at this point, "thanks" to cryptocurrencies.

I remember hearing that they do have customer support, though! Not sure if you can escalate to a sales rep to get a personalized quote or non-profit discount from there.

I think Darknet Diaries talked about that. I don't remember what episode.

> Not sure if you can escalate to a sales rep to get a personalized quote or non-profit discount from there.

some groups offer it (not out of goodness: rather on price discrimination grounds)

Many companies now pay for this kind of insurance. So even though the company may not seem like they have the deepest pockets, it's really more about paying the insurance premiums and the insurer pays the ransom.

I recall a colleague whose firm was hit by a ransomware attack. When they reached out to the insurer and sent them the details of the attackers, the first response from the insurance agent was, "Oh good, they are a reputable group. We've worked with them in the past. They will simply take the ransom and return your network/files to you." My colleague was shocked by the nonchalance.

Ransom insurance seems more like another part of the problem than the solution.

A smart businessman would start both a ransomware group and sell ransom insurance lol.

Can vouch for customer support, they need you to believe that they can actually unlock things when paid. They'll work with you to run a trial/demo to unlock a handful of files and generally will bend over backwards to make sure the "end user" has enough faith that they will get their data back in order to convince them to send the payment.

Really? Have you seen a man eat his own head? No? So then you haven't seen everything. And neither have I.

Just so that people get the reference: https://youtu.be/sBrAfJs0xR0

Right? Like what are they going to delete? The digital books? Who had what checked out?

Kind of like "erase the debts" from Fight Club? "Haven't returned that digital book? Keep it!"

I highly doubt it was targeted.

i bet Sam is getting some e-books /j

lol

A California nonprofit's computers were once stolen only to be returned by the thieves.

That would also have arguably been more risky of a redemptive act than the right thing to do in this circumstance.

Referring to this? https://www.huffpost.com/entry/thieves-apology-note-san-bern...

I am not a crook, but sounds like it was a pretty high-skill thief. So relatively low risk - and catching & punishing that thief mighta been a pretty low priority for everyone from the on-shift cops to the most idealist juror.

That's the one!

Agreed. This is just shitty. Libraries are one of the few things holding the world together right now, and no they don't make tons of money...

Yeah. But if 0.1% of humans are in the bottom 0.1% for personal morality, and there are more than 8 billion humans on the Earth...

and nobody spends their own resources or credit holding others accountable…

At this point I wouldn't be surprised if automated AI agents are probing vulnerabilities and following a preset playbook for extortion without any human involvement.

Today I learned that Queens has a public library system that predated the consolidated New York City library system and fiercely fought to maintain independence rather than come under the control of a Manhattan-based system

Brooklyn too. (Bronx and Staten Island being served only by NYPL, the “Manhattan” one)

And the consequence of this is that I have to get three different library cards haha.

Another consequence is that on the Libby app you have better chances to find something available, and each one’s limits are separate!

The tbree systems in NYC also serve the entire state, not just the city. Any NYS resident can get a card at each. I do and use the e book systems for all at the same time even though I rarely go into the city these days.

Seems that even as three separate systems, they'd at least just let a card from any of them work at all three. Or issue a single unified card and let that be the only point of commonality between them, if all other operations being independent is important to them

Kind of like how many regions will have a unified transit payment card, even if it covers a half dozen completely independent adjacent transit systems

You can also get Buffalo/Erie County.

It seems that NY has a law that allows anyone in the state to be a member at any library in the state, but there's an opt-out if that would put an undue burden on the local system.

In practice, that means anyone in NYS can be a member of any of the NYC libraries + Buffalo. The others have either opted out, require you to visit in person, and/or pay a non-resident fee.

Additionally, a Queens library card is available to anyone world-wide for $50 annually. I have a membership in Canada to access their digital library.

I wish I wasn't learning this information from a comment on this particular story.

It’s a library.

Wipe the system and start again.

should be simple, restore from backup. right ?

When the British Library was hit by ransomware, some systems were down for months. They were old software that didn't run on the newer more secure systems the library had to migrate to. And there was no funding to rewrite them, not without cutting already affected services.

The British Library is still recovering from the 2023 attack, more than three years later... some systems are still not available.

The cost out of the previous administrators' pensions.

So you pull everything off the shelves, enter it into the system, then reshelve it.

The library has something like 5 million books. How many could you enter into an empty system each day? Maybe 1000? That would take a decade to complete.

So the backups are kept online? Crazy. If your backups are connected to the internet, you don't have backups.

I read "wipe the system and start again" as meaning start from scratch, not restore from a backup.

Is this due to the php vulnerability from a few weeks ago? Guessing they were on some php-based cms, and their staff never got around to fixing it in time.

Ransomware infections frequently start with a phished user, not a popped web app.

Not to mention since a few weeks ago several other CVEs have dropped that would have been just as exploitable. Such as *sshole

Unfortunately, QPL has suffered a ransomware incident and currently much of the online access is unavailable

A public library?

Find these people and make them hurt. Like, really hurt. Make them read Jeffrey Archer books.

Shit… for a second I was worried somebody stole the books and encrypted them on paper… hah! But luckily only website is broken it seems… uff.. most important thing in a library is safe… rest seems so much bollocks as a target… what is wrong with this world?!

> ...stole the books and encrypted them on paper...

That explains the Voynich Manuscript, doesn't it?

The post headline could use some punctuation.

Reply on news.ycombinator.com