British Library suffers data breach: what to do if you're affected

The British Library has confirmed that customer data may have been accessed in a recent cyberattack.

The library says that the data may be being sold on the dark web, with a ransomware group having claimed responsibility for the attack.

Read on to find out which personal data has been accessed, and the steps you should take if you're affected.

British Library cyberattack

The British Library, based in London, is one of the largest libraries in the world and heavily relied upon for research. 

It was hit by a ransomware attack in late October, which resulted in the loss of access to its online systems. Its website is still down.

The library says it has evidence that the attackers are likely to have copied user data from its Customer Relationship Management databases.

It has written to all customers who may be affected, and has notified the Information Commissioner's Office about the breach. 

The Rhysida ransomware group has claimed responsibility for the attack, and says it is auctioning off the stolen information on the dark web. 

What does this mean for me?

The library says that, at a minimum, the affected databases contain the names and email addresses of most of its users. 

Postal addresses or telephone numbers belonging to some users may also have been accessed. 

Additionally, the library has confirmed that 'some employee data' may have been leaked. Rhysida says it has documents including passport scans and employment contracts. 

Have my payment details been breached?

The British Library says customer payment details are still safe, as all of its payment processing is outsourced to third-party providers. 

It says it is 'confident' that no credit or debit card data was on the network accessed during the cyberattack.

What should I do if I've been affected?

If you've received a message from the British Library that your data may have been accessed, follow these steps:

• Change your passwords. If you've used the password on your British Library login for other online accounts, it's best to change it. 
• Be cautious about unexpected communications. If your data has been accessed, you may be targeted by scammers in the coming weeks and months. Be on your guard against unexpected emails and phone calls claiming to be from the British Library or other companies, or any dodgy text messages that ask you to call a number or click a link.
• Be on the lookout for signs of identity fraud. This particular breach doesn't appear to have affected your payment details, but as a rule it's a good idea to keep an eye on your bank accounts and credit reports if your data has been accessed.

You can find more advice in our full guide on what to do if your data has been breached. 

Where can I get further advice?

The British Library has set up a blog and temporary webpage where it will provide updates. 

It advises you to contact its data protection officer at data.governance@bl.uk if you have any questions.