Ransomware takes down Queens Public Library’s website, app and Wi-Fi; patron data status unknown
A ransomware attack on 4 November took down Queens Public Library’s website, app, digital media, renewals, checkout machines, public computers and Wi-Fi. All 66 branches are open. The NYPD and FBI are investigating, no group has claimed it, and the library is still working out the impact on its data.
Queens Public Library’s website, app, Wi-Fi and digital media have been down since 4 November. Branches are open; whether patrons’ data was taken isn’t known yet.
What happened
If you use Queens Public Library, its 66 branches are open and there are no late fines while systems are down. But its website, app, digital media, renewals, public computers and free Wi-Fi have been down since a ransomware attack on Wednesday 4 November, and the library doesn’t yet know whether patrons’ information was taken.
Library president and chief executive Dennis Walcott told NY1[1] the library is working with the NYPD, federal partners, City Hall and outside security experts, and is still working out what the attack did to its systems and data. The NYPD says it is investigating with the FBI. There is no date for services to return.
- HARD level
- Watch
- Started
- 4 November 2026
- Down
- Website, app, digital media, renewals, checkout machines, public computers and Wi-Fi
- Open
- All 66 branches; no late fines during the outage
- Patron data
- Unknown; the library hasn’t said whether any was taken
- Who did it
- No group has claimed it
Timeline
-
HARD publishes its article, at Watch.
What isn’t known yet
Ransomware gangs often copy data before they lock systems, and then threaten to publish it. Nothing so far says that happened here: the library hasn’t said whether any data was compromised, and no group had claimed the attack when The Register[2] reported it. HARD will update this page when the library says more.
What to do
- Go in person, and call ahead.Branches are open, but checkout machines are down and some programs may be affected. Ring your branch before you make a trip.
- Ignore messages asking you to “reactivate” your card.Scammers use outages like this. With the library’s website down, any email or text with a link to fix your account should be treated as fake. Follow the library’s official social media for updates.
- Change any password you share with your library account.If your library PIN or password is one you also use elsewhere, change it on those other accounts now, starting with email.
- Watch for a notice from the library.If it finds patrons’ information was taken, it should tell you what, and what to do. Go to the library’s site yourself rather than following a link in a message.
Related
Situations
- Chainalysis says login details for all its users were exposed; customers should reset passwords and rotate API keys Data breach, high, 7 Nov 2026
- DigiCert breach exposed customer contact details, and some passports and driver’s licences Data breach, high, 7 Nov 2026
- Gnosis Pay breach exposed details of its own-brand card customers; funds were not affected Data breach, high, 7 Nov 2026
- MetaMask’s staking service was breached; wallets, recovery phrases and keys were not Data breach, watch, 7 Nov 2026
- Every situation, in the Situation Room
References
- ^ NY1 (). “Ransomware attack disrupts Queens Public Library services”. The services down, what the library’s chief executive and the NYPD said, and that the data impact is still unknown.
- ^ The Register (). “New York’s Queens Public Library battles ransomware crims: Wi-Fi, checkouts, and website go dark”. The library’s statement to patrons, and that no group had claimed the attack.
Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.