Summary

  • British Library's March 2024 review describes a recovery obstructed by destroyed infrastructure and ageing software, despite secure copies of its digital collections.
  • ICO decided in April 2025 not to investigate further. Internal audits did examine parts of the recovery, including an improving retrieval process; neither finding certifies the entire rebuilt system.

The files were there. The machinery needed to turn them back into a library was not.

That is the uncomfortable distinction in British Library's account of the ransomware attack discovered on 28 October 2023. Secure copies of its digital collections and their descriptive records survived. But servers had been encrypted or destroyed, and some of the software that made those collections usable could not simply be installed again. Its suppliers no longer supported it, or it would not run on the new secure infrastructure.

A backup could preserve the material. It could not supply a compatible application, a functioning catalogue and a reliable route from a reader's request to the item wanted. For a national library, those are not optional extras.

An open door was not the same as a restored service

The Library's incident review, published on 8 March 2024, is its own account, informed by specialist advisers. It says the buildings remained open, as did exhibitions, events and access to Reading Rooms. Research services were nevertheless severely restricted. A searchable catalogue returned on 15 January 2024; that was progress, not complete restoration.

The distinction matters because a visitor can see an open building. The dependencies behind a collection request are much harder to see. Old applications, descriptive records, ordering tools and staff procedures all have to work together. Restoring one can leave the next waiting.

The report also describes a security decision that aged badly. Multi-factor authentication had been introduced for cloud applications, but access to the Library's domain and on-site servers was left outside that rollout pending infrastructure renewal. The exact initial entry point could not be established with certainty. That uncertainty does not erase the weakness: ICO later said the attack escalated because an administrator account lacked multi-factor authentication.

What the regulator actually decided

In its statement of 30 April 2025, ICO said further investigation would not be the best use of its resources given its priorities. It commended the Library's openness and supplied guidance.

This was not the July 2024 formal reprimand described in an earlier version of this article. Nor was it a certificate that the rebuilt systems would withstand another attack. A regulator's decision about an investigation and a technical finding about recovery answer different questions.

The same care is needed with the word “audit”. There was audit work, and some of it reached directly into how the Library served readers.

A modest improvement with a useful paper trail

Pages 75–76 of the 2024/25 annual report describe two reviews of the retrieval arrangements introduced after the loss of the library management system. The initial manual process received partial assurance, with improvements required. A follow-up examined an application and digital forms introduced in September 2024. Its rating rose to significant assurance, with minor improvement opportunities.

This is a more useful recovery story than a blanket claim that nothing was checked. A particular process changed; auditors tested its design and operation; the assessment improved. It remained an interim solution awaiting the new library management system.

The annual overall opinion was still partial assurance, with improvements required, across governance, risk management and control. Four core reviews had significant assurance ratings. Those findings can coexist: a better retrieval process does not make every system resilient, and an overall qualified assessment does not mean every repair failed.

The same report records restored physical-collection access and remote ordering, alongside cataloguing backlogs and gaps in digital collecting. These are disclosures about 2024/25, not a live inventory of every service in October 2026. September 2026 trade reporting brought the continuing recovery back into view, but older figures still need their dates attached.

On 22 September, the Library announced Paul Bate's appointment, with a start date of 4 November 2026. He had not yet taken office when this article was published. The handover offers an occasion to ask which services now work, which temporary arrangements remain and what has been tested—not evidence that those questions have already been answered.

For readers, the decisive result is unglamorous: finding a record, ordering the material and being able to use it. The British Library directory entry Only for Strategic Circle identifies the institution; its recovery must be judged through those working services, not a single reassuring headline.

Correction, 20 October 2026: The previous version incorrectly described a July 2024 ICO reprimand and linked to an unrelated parliamentary proceeding. Those claims and references have been withdrawn. The incident review appeared in March, not June, 2024. We have also removed an unverified £7 million figure and corrected the suggestion that no recovery-related assurance work was reported.