Ransomware
Queens Public Library ransomware: running branches offline
Ransomware took down Wi-Fi, PCs and checkout at all 66 Queens library branches. What is known, and what small public bodies should have ready.
Queens Public Library in New York City posted alerts about a systemwide network outage on the afternoon of Wednesday, November 4. Hours later, that evening, it told patrons on social media and directly that the cause was ransomware. The website, mobile app, digital media services, self-service checkout and return machines, renewals, on-site public computers and free public Wi-Fi all went down across its 66 branches.
The branches stayed open on their normal schedules, and the library said some virtual and in-person programs might be affected. On Thursday morning the digital services were still unavailable, and library officials could not say when they would return. The library is working with law enforcement and outside cybersecurity experts. As of Thursday evening no ransomware group had claimed the attack, and neither the library nor the reporting so far has said whether patron or staff data was taken. For any library system, council or shared-service organisation, the useful part is what a day of service looks like with every system off, and what has to exist beforehand to make that day work.
What is known, and what is not
The confirmed picture is short. Ransomware disrupted the network, the library's public-facing digital services stopped, and staff kept buildings open. Patrons are not being charged late fines while the outage lasts, and the library has said it will take some time before its network and systems are restored.
Four things have not been disclosed: how the attackers got in, who they are, whether data left the network, and when services come back. We are not going to guess at the entry point. Each of those answers changes what Queens staff and patrons need to do next, and the library will know more once its investigators have looked at the logs and disk images.
What an outage looks like at the desk
A modern branch runs almost every transaction through one integrated library system: the catalogue, patron records, holds, checkout and the kiosks that talk to them. When that system and the network under it go dark, the building is still full of books and people, but staff cannot look up a card, record a loan or check an item in.
The public loses more than convenience. NY1 spoke to a patron who uses the library computers three or four times a week and could not print documents. For patrons without home internet, branch PCs and Wi-Fi may be their only way online, and a long outage moves that need onto staff at the desk.
Recovery takes longer than people expect. Toronto Public Library was hit by ransomware on October 28, 2023. It did not pay, staff data was stolen from its servers, and services such as public computers, holds and the online catalogue came back in stages through January and February 2024, about four months after the attack.
Running the branches without systems
The offline kit for a library fits in a drawer, but it has to be there before the outage.
Paper checkout slips should capture the card number, the item barcode, a due date and the staff member's initials. That is enough to key the loan in later. Without a lookup, staff also need some way to confirm a card is valid: a card-number export taken on a schedule, dated and kept offline, works for that. Keep it encrypted, because it is patron data.
Returns are the harder half. Items come back that the system still shows as on loan, so keep a returns log and a separate shelf area for unchecked-in items, and do not put them back into circulation until the record is fixed. Decide in advance who keys the paper slips back in and when, so that two branches do not enter the same batch twice.
Front-line staff also need a short script and printed signs: what works today, what does not, and that no fines are being charged. Patrons will ask whether their data is safe. The honest answer while the investigation runs is that the library does not know yet, and that it will tell them when it does.
Keeping the blast radius small
Libraries run a public network on purpose: guest Wi-Fi and public PCs used by thousands of strangers. That network should reach the internet and nothing else. Put guest Wi-Fi and public PCs on their own VLAN (a separate virtual network) with firewall rules that deny any route to staff subnets, servers or management interfaces, and test that rule from a public PC.
Staff PCs, circulation servers and self-service kiosks belong in their own segments too, with only the ports the circulation software needs open between them. Server administration should come only from dedicated admin hosts, not from the PC an employee uses for email. The US Cybersecurity and Infrastructure Security Agency (CISA) #StopRansomware guide recommends this kind of segmentation to limit how far an intruder can move.
Backups decide how long the outage lasts. CISA recommends keeping offline, encrypted backups and testing them regularly. In practice that means backups an attacker with domain admin rights cannot delete, either offline or on immutable storage, behind logins that are separate from the main directory. Run a timed restore of the catalogue and patron database at least once a year, so the restore time is a number on paper rather than an estimate.
Who to call, and when to tell patrons
The first day goes better when names and numbers are already written down. Isolate affected systems at the switch or firewall, and copy their logs and take disk images before anything is rebuilt. Then call your incident response firm, your cyber insurer and your local FBI field office, which CISA lists as a reporting route. If email and chat run on the systems that were hit, coordinate by phone; CISA recommends out-of-band communication for this reason, and a hard copy of the response plan.
Post a status page somewhere the attackers cannot touch, such as a separately hosted page or the library's social accounts, and update it at set times every day, even when there is nothing new.
Have patron notification ready too. Pierce County Library System in Washington State found attackers had been in its network from April 15 to 21, 2025, and in December 2025 it notified more than 340,000 people. Patrons' names and dates of birth were exposed, and for current and former employees and their families the data included Social Security numbers, driver's license and passport numbers, and financial and health insurance details. Every US state has a breach notification law and many set deadlines, so know which apply to you, who drafts the letter and who signs it.
What to do this month
Put a paper checkout kit in every branch and run one desk on it for an hour. From a public PC, try to reach a staff server and confirm the firewall blocks it. Restore the patron database from backup to an isolated host and time it. Then print the call list.
Our security operations team watches for the early signs of an intrusion and helps with containment and evidence, and our safeguarding and hardening work covers the segmentation, backup isolation and restore testing described above. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would run the work.
Sources: The Record, NY1, The Register, CBC on Toronto Public Library's recovery, Global News on Toronto Public Library, BleepingComputer on Toronto Public Library, The Record on Pierce County Library System, SecurityWeek on Pierce County Library System, CISA #StopRansomware Guide.