{
  "id": "queens-public-library-ransomware",
  "url": "https://ohshit.app/incidents/queens-public-library-ransomware/",
  "title": "Ransomware disrupts Queens Public Library across all locations",
  "level": 3,
  "level_name": "sharted",
  "date": "2026-11-04",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "ransomware",
    "public services",
    "library"
  ],
  "ecosystems": [],
  "summary": "Queens Public Library confirmed a systemwide ransomware outage. Checkout and return machines and Wi-Fi have been restored at open locations; the website, app, public computers and digital media services remain affected.",
  "splash": "Queens Public Library patrons and programs relying on its branch computers, website, app, renewals or digital media services.",
  "wipe": "Check the library's outage page and confirm service availability with your branch before relying on a service.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Check which services are running before visiting",
      "hint": "Open the library’s official outage page or call (718) 990-0728. Locations remain open as scheduled; confirm any virtual or in-person program with your branch. If you need a public computer or digital media access, ask the branch for an alternative before you travel."
    },
    {
      "title": "Confirm how to handle loans while renewals are unavailable",
      "hint": "The library says checkout and return machines are back at open locations and reminds patrons that it does not charge late fines on borrowed materials. Check with your branch if you have an item to return or need to confirm its status."
    },
    {
      "title": "Verify any requests about your library account",
      "hint": "Use the library's official outage page or a known branch contact to verify messages about account resets or payments. Do not provide a library PIN or other personal details through an unsolicited message. Follow the library's official notices for any later data or account guidance."
    }
  ],
  "sources": [
    {
      "name": "Queens Public Library network outage page",
      "url": "https://connect.queenslibrary.org/",
      "says": "Confirms ransomware, current service availability, renewal outage, no late fines and the assistance number.",
      "primary": true
    },
    {
      "name": "Public copy of the library's November 4 announcement",
      "url": "https://teapaw.org/QPLNYC/status/2118128693914874122",
      "says": "Original library thread with UTC timestamp, affected services and coordination with law enforcement and experts.",
      "primary": true
    },
    {
      "name": "Public copy of the library's restoration update",
      "url": "https://teapaw.org/QPLNYC/status/2118874433838305413",
      "says": "Original library thread gives the UTC posting time and specifies which services had returned.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "QPL confirmed ransomware; it has not confirmed theft of patron data.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 4, 23:50 UTC",
      "title": "Queens Public Library confirms ransomware across its network",
      "body": "All locations were affected. The library said it was working with law enforcement and cybersecurity experts."
    },
    {
      "date": "Nov 7, 01:13 UTC",
      "title": "Checkout and return machines and Wi-Fi are restored at open locations",
      "body": "The library website, mobile app, on-site computers and digital media services remained affected. Renewals were still unavailable."
    }
  ],
  "body_markdown": "Queens Public Library confirmed that ransomware disrupted the network serving all its locations. Branches stayed open, although some programs could be affected. The first confirmation covered the website, mobile app, on-site computers, digital media services, self-service checkout and return machines, and public Wi-Fi. The later update restored machines and Wi-Fi at open locations; it did not announce full recovery.\n\nThe library has not publicly identified the entry point, ransomware group, a recovery deadline or the scope of any patron-data access. L3 reflects the disruption to a public library network across all locations. The outage does not establish theft of patron records or a compromise of a particular vendor.\n\nQPL published its [initial confirmation](https://x.com/QPLNYC/status/2118128693914874122) and [restoration update](https://x.com/QPLNYC/status/2118874433838305413) on its official social account. The cited public copies preserve both threads."
}