New York's Queens Public Library battles ransomware crims: Wi-Fi, checkouts, and website go dark

New York City's Queens Public Library (QPL) is currently grappling with a ransomware attack, as the library system announced via social media and direct communication to patrons on Wednesday evening. The attack has impacted various aspects of QPL's services, including its website, on-site computers, check-out and return machines, public Wi-Fi, mobile app, and digital media services. Notably, renewals are currently unavailable, although patrons are not penalized for returning materials late beyond the usual grace period.

Interestingly, since 2021, QPL, along with Brooklyn Public Library and New York Public Library, have eliminated daily late fines for books and circulating materials in an effort to make borrowing more accessible for low-income users. Despite this, QPL warned that restoring its network and systems will take some time. Certain virtual and in-person programs may also be affected, and visitors are advised to check availability with their local branch via phone or check the library's social media channels for updates.

The library system's IT department is actively working to resolve the issue and keep stakeholders informed. However, no specific ransomware group has claimed responsibility for the disruption. While ransomware attacks on publicly funded institutions typically do not result in substantial payouts, the British Library's experience in 2023 demonstrates the potential financial and operational consequences of such attacks.

In that incident, the British Library refused to pay a 20 Bitcoin ransom demand and instead opted to pay for an IT rebuild using its cash reserves and subsidies. This approach, while drawing praise, is not feasible for most libraries due to financial constraints.

The 2025/26 annual report of the British Library, published in July, revealed that its recovery efforts are ongoing and not yet complete. Restoration of customers' ability to purchase electronic resources and reopen access to electronic legal deposit content is expected to be completed by the end of 2026.