The Queens Public Library in New York City says a ransomware gang has encrypted parts of its systems and taken many of its digital services offline. The system, which operates 66 branches serving the borough’s 2.3 million residents, confirmed the attack in multiple alerts published on Wednesday after first warning of outages that afternoon.

What is affected

According to the library’s social media statements, the following services are currently down:

  • On-site computers
  • Check-out and return machines
  • WiFi access
  • Digital media services
  • The library’s mobile app

The library said all Queens Public Library locations remain open as scheduled, though some virtual and in-person programs may be affected. It stated that it is working with law enforcement and cybersecurity experts to respond to the incident. New York City officials had not responded to requests for comment at the time of reporting.

Scope of the library system

Queens Public Library is among the largest library systems in the country. It offers free access to more than 5 million books in 50 languages, runs dozens of learning centers in public housing complexes across the borough, and operates several mobile libraries.

A pattern across public libraries

Public libraries have repeatedly been targeted by ransomware operators, who use the disruption of e-book lending and other critical services as leverage to pressure organizations into paying. Previously reported incidents include attacks on Seattle Public Library and several city and county library systems. In 2023, the British Library, the national library of the United Kingdom, suffered destruction of its systems, and the Toronto Public Library spent months recovering from an attack that year.

Library networks also hold substantial data about local residents. A ransomware attack on Washington State’s Pierce County Library System last year exposed the information of more than 340,000 people, illustrating the privacy risk beyond service outages.

Attribution status

As of Thursday evening, no ransomware group had publicly claimed responsibility for the Queens attack. Defenders in the public sector should treat this incident as a reminder to validate offline backup integrity, segment networks that support public-facing services, and maintain tested incident response plans.