© Copyright 2026 Mastersinlibraryscience.org.
How catalog breaches, ransomware, and outage recovery shape the skills librarians now need
A library whose catalog, website, and reading-room request system all go dark at once is not having a website problem. When ransomware hit the British Library in October 2023, roughly 600 GB of data was exfiltrated before the Library took its systems offline.
Cyberattacks hit digital libraries in a rough order: access first, the integrity of stored files second, patron privacy last, and often quietly.
ALA-accredited MLIS programs cover preservation as a matter of course, but the security skills that keep preservation copies intact usually appear as electives. The systems librarian is often the only person standing between a clean fixity check and a ransom note.
A weeklong outage and a corrupted preservation master can both follow the same breach, but only one can be fixed with an apology and a status page.
Cyberattacks affect digital libraries by taking systems offline, damaging or altering stored files, and exposing patron records, usually in that order of frequency. The first is an availability problem: the catalog, discovery layer, or interlibrary loan queue goes dark, and staff fall back to spreadsheets and email. The second is a preservation problem. An outage blocks patrons for a week; tampered masters, broken metadata links, or encrypted archival files can destroy records that were never sold on the open market and cannot be re-purchased.
Most libraries are not high-value targets in the way banks are. They are targets of opportunity: public-facing systems, thin IT staffing, high patron trust, and heavy reliance on a small number of vendors whose platforms serve many institutions at once. That concentration turns one weakness into many victims.
The damage shows up as stalled digitization, lost ILL service, broken discovery links, and patrons who stop trusting the institutional login. The dollar cost matters, but the service interruption and the erosion of trust linger longer.
The threat breaks down system by system, from the public catalog to the repositories behind it.
Every system in a digital library is an entry point, and each one fails for patrons in a different way.
Vendor concentration is the risk directors underrate: a single compromised platform can expose dozens of member libraries at once. Ask a vendor who else it hosts, and put breach notification timelines in the contract before renewal.
Rhysida, the ransomware group behind the October 2023 British Library attack, exfiltrated roughly 600 GB of data (by its own claim, 573 GB across 490,191 files) before the Library's systems went dark.
The UK Information Commissioner's Office linked the escalation to an administrator account without multi-factor authentication, and a later technical review said forensic evidence indicated the attackers likely had access at least three days before staff noticed. The Library then took most of its IT offline deliberately: website, online catalogue, staff email, on-site Wi-Fi and payment terminals all stopped.
Online service was absent for more than two months. The catalogue returned in usable but incomplete form on January 15, 2024, and electronic collection access was still down five months after the attack. A January 2024 estimate put recovery at £6 million to £7 million, possibly consuming about 40% of reserves; the Library later qualified that figure, and no final audited cost has been published. Legal-deposit and document-supply work fell back to manual, off-system processes, and by July 2024 the target for restoring key services was early September, with a comprehensive rebuild expected to take years.
In November 2023 attackers released stolen material on the dark web, including user names, contact details and membership account information. Personal data relating to staff was later published after the Library refused to pay a ransom. Financial information was not believed compromised, and no complete public inventory of what was taken has been established.
The backups existed. Restoring them was slow and partial, which is why continuity planning matters as much as having a backup at all.
Three incidents at very different institutions show what a security failure actually costs a library in time, money, and patron trust. The figures below are limited to what each institution or its local press has published. What these incidents have in common is slow restoration and uncertain data exposure, not any single attack method.
| Library | Attack type | Services offline | Outage duration | Reported recovery cost | Data exposed |
|---|---|---|---|---|---|
| British Library (national research library) | Rhysida ransomware | Not publicly reported in the cited sources | Recovery took most of a year | Not publicly reported | Not publicly reported |
| Toronto Public Library (large public system) | Cyberattack (sources describe an attack without labeling it ransomware) | Public computers, website, catalog and account access, some digital materials and databases; branches stayed open and materials were checked out manually | Digital services fully restored in February 2024; exact start date and total duration not publicly reported | Not publicly reported | Not publicly reported |
| Seattle Public Library (large public system) | Ransomware | Internet access, public computers, catalog, and in-person book checkouts; branches remained open | About 103 days, from Memorial Day weekend until September 4, 2024 | About $1 million by the end of 2024, including about $800,000 for consultants and $200,000 in additional IT costs | Data was downloaded; the library said affected people would be notified, but the extent and specific types of personal data had not yet been determined |
Preservation storage design now assumes immutability, even while published guidance stays deliberately non-specific about durations and products. What the standards describe is a control, not a vendor feature: object-locked or write-restricted primary storage where no single person can alter every copy.
A nightly backup restores a system. A preservation master is the trusted copy you restore from. Ransomware that encrypts both is a preservation failure, because the object you promised to keep no longer exists in verifiable form. The Digital Preservation Coalition asks for at least one readily accessible copy on non-removable disk plus at least one more on less accessible, less expensive media such as tape. The 3-2-1-1-0 shorthand adds an offline or immutable copy and, in the final zero, zero verification errors. Refresh that offline copy on a schedule; the DPC handbook offers six months as an example, not a rule.
Checksums are how you prove a restored file was not silently altered. Generate manifests at ingest when none arrive with the deposit, store fixity records with the materials and again in a separate system, and schedule audits at fixed intervals with logs and on-demand audit capability. MD5 and SHA-1 are the commonly cited examples; consistency matters more than the algorithm.
A file that opens is not a passed test. Test periodically, including recoveries from third-party backup services where used, then recalculate checksums against the trusted stored value, investigate discrepancies, and document the outcome. Verify metadata, identifiers, and links as carefully as the bitstreams; discovery breaks quietly when only the files are checked.
ALA-accredited programs do not publish a single security track, so the honest way to read the curriculum is by competency area rather than by school ranking. Preservation coursework is widely available; hands-on security operations work usually appears as an elective or a continuing-education certificate. The frameworks programs actually map to are the ALA special collections competencies and the Digital Preservation Coalition Competency Framework.
| Competency area | What it covers in practice | Typical MLIS course or certificate | Where it sits in the curriculum |
|---|---|---|---|
| Digital preservation and fixity | Managing digital collections and metadata systems, leading digitization and digital preservation initiatives, and maintaining ongoing access to born-digital and digitized material | Archiving sequence covering records management, digitization, and digital preservation (University of Denver); INF 7920 Digital Curation and Preservation (Wayne State) | Optional sequence or recommended career pathway, not a universal degree requirement |
| Metadata and collection organization | Standards and best practices for organizing, describing, and appraising digitized and born-digital collections | INF 7910 Metadata in Theory and Practice (Wayne State); ALA special collections competencies address description and appraisal of digital collections | Elective within a digital content pathway; the underlying knowledge is framed as a baseline expectation for ALA-accredited graduates |
| Digital library systems and platforms | Building and running digital library services, including the platforms that hold and serve digital collections | INF 7900 Digital Libraries (Wayne State) | Recommended pathway course rather than a stated universal requirement |
| Security fundamentals | Cybersecurity concepts as they apply to information organizations and their technology environments | INFO 287 Cybersecurity (San José State University School of Information) | Emerging-technologies elective or seminar topic; not established as a required MLIS course |
| Preservation planning frameworks | Structured mapping of the skills, knowledge, and competencies needed for successful digital preservation work, from generic to granular levels | Digital Preservation Coalition Competency Framework, used as a skills map rather than a course title | Continuing-education and self-assessment framework; the framework does not set out a security competency list or security course requirements |
| Privacy and data ethics in collections work | Equitable access to historical information and responsible stewardship of records about people and communities | Archiving coursework on community-centered archival practice (University of Denver); ALA special collections competencies on managing and preserving digital collections | Embedded in elective archiving and special collections coursework rather than taught as a standalone security course |
The systems librarian keeps a library's digital collections reachable and recoverable, and in 2026 that is a security job as much as a technical one.
Systems librarians own the integrated library system, the discovery layer, the institutional repository, and the vendor relationships behind all three. They often carry no formal IT authority, so the security work lands sideways: patch cadence, account and access reviews, single sign-on configuration, and backup verification. When a catalog goes dark, this is the person who fields the calls.
The function runs through a triangle: campus or municipal IT, the vendor, and the library director. Contracts should spell out breach notification timelines, patron data export rights, and exit rights, so a library can leave a platform without abandoning its records.
Most systems librarians grew into the role from cataloging, metadata, or reference work plus hands-on systems experience. Few arrive with a security background, which is why digital preservation and information security coursework carries real weight for anyone heading this direction.
Small and volunteer-run libraries push the function onto the director or a consortium. Membership buys shared infrastructure, monitoring, and expertise that a single building cannot staff on its own.
Notification duties split along institutional lines. A public library usually answers to its state's breach-notification statute, sometimes through a municipal or county legal office. An academic library layers campus counsel, the registrar, and IT governance on top of the same statute, so the decision-maker is rarely the library dean alone.
In 2026, 20 states set numeric consumer deadlines of 30 to 60 days, and 31 rely on a "without unreasonable delay" standard.1 California gives individuals 30 days and, for breaches touching more than 500 residents, requires attorney general notice within 15 days after that.2 Delaware sets 60 days for attorney general notice.2 These are consumer deadlines; regulator and credit-bureau notices often run on separate clocks.
Library-records statutes restrict what may be said even during an incident. Florida makes public library registration and circulation records confidential.3 Maine protects identifying information and use records for public, state, university, and community college libraries, releasing them only by written patron permission, administrative need, or court order.4 Texas bars disclosure of identifying request and use information.5 Notice letters should carry statutory content only: what happened, what data, protective steps, remediation, contact.
FERPA governs education records held by institutions receiving federal funds. It does not itself set breach-notification deadlines, and patron borrowing data generally falls outside its scope.
Draft templates, name a decision-maker, and write the escalation path before an incident.
In Vermont, 71 percent of libraries rely on volunteers and 73 percent are open fewer than 40 hours a week. A large share of small U.S. libraries operate this way, which rules out most security products pitched to them.
Start with the measures that cost nothing: multifactor authentication on every administrative account, prompt patching, least-privilege access so volunteers see only what their task requires, and one offline backup that someone has actually restored from. Tested beats encrypted-and-untested.
Nationwide, 81 percent of libraries cite insufficient financial resources and 57 percent cite insufficient staff capacity, so look for no-cost support before buying tooling. CISA offers free online training, cyber hygiene services, tabletop exercise packages, and access to a regional cybersecurity advisor. The FCC Schools and Libraries Cybersecurity Pilot allows $15,000 pre-discount annually per eligible library, up to 11 sites, with system-level caps near $175,000. Those are ceilings for eligible applicants, not typical spending.
For a volunteer-run library, the deliverable is a one-page checklist plus a continuity plan naming who calls whom when the catalog goes dark. Get vendor commitments in writing: breach notification, full data export, and a documented exit path if the vendor is compromised.
Do this first: switch on MFA for every administrative account before Friday.
The national median annual wage for librarians and media collections specialists is about $68,270.
The table below uses May 2025 Occupational Employment and Wage Statistics from the U.S. Bureau of Labor Statistics. It describes occupations, not graduates of any single MLIS program, and the link between a degree program and an occupation is many-to-many. Read the 25th-to-75th percentile spread as the practical range: role, sector, and specialization move pay more than the credential alone.
| Occupation | Total employment | 25th percentile wage | Median wage | 75th percentile wage |
|---|---|---|---|---|
| Librarians and Media Collections Specialists | 133,790 | $56,310 | $68,270 | $84,480 |
| Librarians, Curators, and Archivists (broad group) | 234,910 | $45,480 | $60,470 | $78,000 |
| Education and Library Science Teachers, Postsecondary | 64,460 | $55,740 | $75,640 | $97,840 |
| Library Science Teachers, Postsecondary | 3,630 | $64,080 | $80,340 | $100,910 |
