In late October 2023, the British Library suffered a significant data breach that exposed employee and customer data, including potentially sensitive personal information. The breach was the result of a cyberattack by a group called Rhysida, who have rapidly emerged as one of the most prominent cybergangs in the world.
The attack – which may leave the British Library’s systems offline for months to come – is just the latest case of cybercriminals getting access to personal information in order to demand a ransom. This growing threat from so-called “ransomware” attacks is undoubtedly highly concerning. If your data is stolen and leaked on the dark web, it can easily result in financial losses or identity fraud. And even simply the prospect of this kind of outcome can lead to anxiety and emotional distress.
In this post, we’ll explore the details of the British Library hack and suggest some steps you should take if you’ve been affected. We’ll also highlight the importance of seeking compensation if you’ve been impacted by a data breach – and give some guidance on how to get started with your claim.
How did the British Library data breach occur?
The British Library data breach took place on 31st October 2023, when a cyberattack resulted in the organisation’s website, catalogue, and digital collections going offline. The library subsequently announced that this was a ransomware attack, and that data from their internal HR files had been leaked.
This initial announcement stated there was “no evidence” that user data had been compromised. However, it was subsequently made clear some customer data had in fact been stolen by the attackers and shared on the dark web.
On 22nd November 2023, the cybercrime group Rhysida claimed responsibility for the attack. As in many such cases, their goal was to extort payment from the organisation whose data they had stolen, threatening to sell the data online if they don’t receive the money.
In this case, the group asked for payment in cryptocurrency, equivalent to around £600,000, with a deadline of 7 days. Once the deadline had passed, the group then posted what they claimed to be 90% of the stolen data on the dark web.
The Rhysida group has emerged as a major cybercrime threat over the past six months, claiming responsibility for a number of prominent attacks on education, health and government institutions, including a ransomware attack on the US healthcare company Prospect Medical Holdings.
What data was stolen in the British Library data breach?
It can be difficult to tell what kinds of data have been stolen in a cyberattack. The attack often leaves the victim’s IT systems offline, making it difficult to assess the damage. And needless to say, the cybercrime gangs cannot be trusted to be honest about what data they’ve managed to steal.
In the case of the British Library data breach, Rhysida claimed to have stolen more than 490,000 files, totalling 573 gigabytes of data. The British Library themselves have only confirmed that employee and customer data was stolen, and that the customer data included names and email addresses “at a minimum”.
A further report by the tech news website TechCrunch indicates that the situation may be significantly worse for employees. The report found that invoices, salary details and passport scans formed part of the stolen data.
Nevertheless, the British Library is confident that customer payment information was not among the data stolen by Rhysida. The library uses a third-party vendor for processing payments, and as a result do not store customers’ card details internally.
How do I know if I’ve been affected by the British Library data breach?
In its communications with customers, the British Library has made clear that cybercriminals were able to get access to both employee and customer data.
The library claimed in a statement on its website that it will be in direct contact with any customers to provide information. If you are a customer but have not received an update, you should contact the library directly to discuss the situation.
What should I do if my data has been exposed?
The British Library has advised any customers to change the password for their accounts, as well as any other accounts that use the same password. This is sensible advice, but there are further steps you should take if your data may have been exposed – or if you just want to protect yourself against the risk of a data breach:
- Use a password manager. It’s best to use a unique password for every online account, and to use strong passwords that don’t follow obvious patterns. Of course, this can make it virtually impossible to simply remember all your passwords. Instead, use a password manager – a piece of software that safely stores all your passwords for online accounts.
- Activate two-factor authentication. Most online services will offer two-factor authentication for your account. This means that, in addition to your password, you will need some other information to log on. This could be a code that is emailed to you or sent to you in a text message. Two-factor authentication means that, even if your password is stolen, your account is still safe.
- Be wary of phishing scams. If your data is exposed in a breach, cybercriminals may try to use this data to get further information from you. For instance, they may impersonate the British Library, using your name and address from the data breach in order to convince you to send them your personal details. It’s important to be wary and double-check any emails or messages are from an official source.
- Check your bank statements. Identity fraud and financial losses are two major risks of data breaches. If your information has been exposed, be sure to check your statements carefully to make sure there are no transactions you don’t recognise.
If you’d like more information on staying safe following a data breach, read our in-depth blog post on the subject.
HNK Solicitors can support your data breach claim
Ransomware attacks have become increasingly common in recent years. Despite cybercrime gangs seeing a drop in earnings, the activities of Rhysida and other similar groups show the threat is still high.
That’s why it’s important to know that, if you’ve been the victim of a data breach, you are entitled to seek compensation. If a data breach has had a significant impact on your life – for instance, if it has led to financial losses or emotional distress – you may be able to pursue a compensation claim to help you recover from the incident.
If you are considering seeking compensation as the result of a data breach, it’s important to consult a solicitor with experience in supporting data breach claims. They will be able to give you tailored advice based on an in-depth understanding of the relevant regulations.
Here at HNK Solicitors, we have extensive experience in helping our clients get the data breach compensation they deserve – take a look at our case studies page to see some of our recent success stories. We also offer free consultations, with no obligation to pursue a claim. So, if you’ve been affected by a data breach, get in touch today on 0151 668 0809, or email us at enquiries@hnksolicitors.com.
