Queens Public Library in New York City has confirmed that a ransomware attack knocked out its online and networked services across all 66 locations. The library is one of the largest public library systems in the United States and serves the borough's roughly 2.3 million residents. Its website, mobile app, public computers, Wi-Fi, digital media services and self-service checkout and return machines all went down. The buildings stayed open on their normal schedules. The library has not said who is behind the attack, whether a ransom was demanded, or whether patron data was accessed. As of Thursday evening, The Record and The Register both reported that no ransomware group had publicly claimed responsibility.
What Happened
On the afternoon of Wednesday, November 4, the library posted alerts about a system-wide outage without giving a cause. Hours later that evening it confirmed the cause was ransomware, through social media and messages sent directly to patrons. The Record reports that the library said a ransomware gang had encrypted its systems. DysruptionHub points out that neither notice says when the intruders first got in.
Here is what the library and press reports say was affected:
- Public-facing systems: the website (reported by The Register and NY1, and DysruptionHub could not load it during a Thursday morning check), the mobile app and digital media services.
- In-branch systems: on-site public computers, public Wi-Fi, and check-out and return machines.
- Circulation: renewals are unavailable. The library reminded patrons that it does not charge late fines. Queens, Brooklyn and New York public libraries dropped daily late fines in October 2021.
In its statement, the library said "all QPL locations remain open as scheduled; however, certain virtual and in-person programs may be impacted." It warned that "it will take some time before the Library's network and systems are restored." The statement quoted by The Record says the library is "working closely with law enforcement and cybersecurity experts." The version reported by The Register says its IT department is working to resolve the issue. TMC Insight, citing Gothamist, also reports that law enforcement and outside specialists are involved. Patrons are being told to call their local branch about programs and to follow the library's social media for updates. New York City officials did not respond to The Record's requests for comment.
One local report, Hoodline, mentions a separate record that said only three branches stayed open. That conflicts with the library's own statement that every location remains open, and the library's account should be treated as correct. A breach tracker, Scambaba, quotes the library's CEO as saying more than 1 million people use the system each year. That figure has not been independently confirmed.
What Was Taken
Nothing has been confirmed. The library has not said whether patron or staff data was accessed or stolen, and no ransomware group's leak site has been publicly confirmed as listing the library. No regulator filing or breach notification has been published.
There is one claim to watch. Migliaccio & Rathod, a class-action law firm, says "dark web monitoring sites" named Queens Public Library as a data breach victim on November 5. It also says the affected data is "believed to include sensitive and personal data." The firm names neither the group nor the data involved. That claim conflicts with The Record and The Register, which both reported no claim of responsibility as of Thursday evening. Until the library or a confirmed leak-site listing says otherwise, treat any data theft as unconfirmed.
Library systems typically hold patron names, addresses, phone numbers, email addresses, library card numbers and borrowing histories. Some also hold payment details or data linked to ID documents. Many ransomware groups now copy data before they encrypt systems, then threaten to publish it to force payment. So whether data was stolen is the key open question here.
Why It Matters
Public libraries keep getting hit by ransomware. The Record and The Register point to earlier cases:
- The British Library (2023): attacked by the Rhysida group. It refused a 20 Bitcoin ransom demand, spent its cash reserves and paid millions to rebuild its IT.
- Toronto Public Library (2023): spent months recovering from an attack it called a "crime scene."
- Seattle Public Library, among dozens of other city and county systems.
- Pierce County Library System, Washington (April 2025): catalog and self-checkout went down while physical borrowing continued, according to DysruptionHub.
- Kent District Library, Michigan (April 2026): branches closed after a ransomware attack, according to DysruptionHub.
Libraries are attractive targets because they are publicly funded, often have small security budgets, and run services people rely on daily. For many Queens residents, library computers and Wi-Fi are their only way to apply for jobs, reach government services or do schoolwork. The Record notes that attackers use demand for e-books and essential services as a lever to push payment. The Register notes that public institutions rarely produce big payouts, and that few can afford a British Library-style refusal and full rebuild.
Queens Public Library also runs learning centers in public housing complexes and mobile libraries. That means the outage reaches people who may have no other internet access.
The Attack Technique
The library has not disclosed how the attackers got in, which ransomware strain was used, or how long they were inside the network before encryption. No technical indicators have been published.
The outage itself does say something about the network. Public computers, Wi-Fi, self-service kiosks, the website and the app all failed at once across 66 sites. That points to either shared central infrastructure (identity, network management or the integrated library system) or a deliberate shutdown to contain the attack. It is not clear which. The library's warning that restoration "will take some time" suggests wide encryption or a rebuild from clean images, not a quick fix.
In similar sector cases, common ways in have included stolen or reused remote-access credentials without MFA, unpatched VPN and edge devices, and phishing. None of these has been tied to this incident.
What Organizations Should Do
- Separate patron and staff networks. Public Wi-Fi, public computers and self-service kiosks should sit on networks isolated from staff systems, the integrated library system and identity infrastructure, so that one compromise does not take down every service across every branch.
- Lock down identity and remote access. Require phishing-resistant MFA on VPN, remote desktop, cloud admin consoles and privileged accounts. Audit service accounts and vendor access, which smaller public bodies often overlook.
- Keep offline, tested backups. Keep immutable or offline copies of the library system database, directory services and core server images. Regularly test restoring them within a set time, not just whether the backup job finishes.
- Practise working manually. Write down and rehearse paper-based circulation, offline patron lookup and branch communication plans. That way buildings can stay open, as Queens did, without staff improvising.
- Patch and monitor internet-facing devices. Keep an inventory of firewalls, VPNs and web-facing applications, apply critical patches quickly, and watch for signs of data being copied out (unusual outbound transfers, use of archiving tools) that comes before encryption in double-extortion attacks.
- Plan breach notification now. Map what patron data you hold and where, so you can quickly tell regulators and patrons what was affected if data theft is confirmed. Uncertainty also invites lawsuits, as the class-action firm's investigation here shows.
Sources: Ransomware Attack Disables Queens Library Services | Queens Public Library says ransomware attack disrupted Wi-Fi, on-si... | New York's Queens Public Library battles ransomware crims: Wi-Fi, c... | Queens Public Library Data Breach Investigation - M&R | Queens Public Library Ransomware Attack (November 2026): What We Kn... | Queens Public Library ransomware disrupts services | Queens Public Library Ransomware Attack Knocks Out Services | Cybercrime Wire For Nov. 6, 2026. Ransomware Strikes NYC Queens Pub...