· By Chris Kirby
The British Library ransomware attack: one login without MFA
When a cyber attack hits a well-known organisation, we usually only get a few details: something happened, systems are down, investigations are ongoing. The British Library did something unusual. After a serious ransomware attack in 2023, it published a detailed, honest review of what went wrong.
That openness is a gift to everyone else, including small businesses. Because the lesson at the heart of it isn't about advanced hacking. It's about a single exception that made sense at the time.
What happened at the British Library
On 28 October 2023, the British Library was hit by a ransomware attack that took most of its online systems down. The attack was claimed by a criminal group called Rhysida. Ransomware is a type of attack where criminals lock up or steal an organisation's data and demand payment.
In March 2024 the Library published its own review of the incident. It found that the most likely way in was through compromised login details belonging to a third party, possibly obtained through phishing (a fake message designed to trick someone into giving away their details).
Those login details were used on a remote-access server. That server was protected by firewalls and antivirus software, but it was not protected by multi-factor authentication, often shortened to MFA (British Library cyber incident review; Computer Weekly).
The exception that mattered
Here's the part that makes this story so relevant. The British Library wasn't ignoring MFA. It had rolled MFA out elsewhere in 2020. But this particular connection had been left out of scope, for reasons of cost and practicality.
The review said the absence of MFA was "likely" to have contributed to the attack (British Library cyber incident review).
In other words, the Library had good protection in most places. The gap was one exception, which probably seemed perfectly reasonable when the decision was made. That's what makes it such a useful example. It's not a story about carelessness. It's a story about how security is only as strong as the one thing you meant to get round to.
What MFA actually does
Multi-factor authentication simply means that a password on its own isn't enough to log in. You also need a second thing, usually a code from an app or a text message, or a prompt on your phone.
Why does that matter so much? Because passwords get stolen all the time, often through phishing, exactly as the Library's review suggests may have happened. If a criminal has someone's password but not their phone, MFA can stop them at the door. Without it, a stolen password may be all they need.
Why this matters for a small business
Small businesses have exceptions too. They're usually not deliberate decisions in a meeting; they just build up over time. For example:
- the old admin login for the website that nobody uses any more;
- an account a former contractor or supplier still has access to;
- a service someone set up years ago that nobody quite remembers;
- a shared login that's "only used now and then".
Each of these can be a door with only one lock on it. And just like the British Library's remote-access server, it's often a third party's access, such as a supplier, a developer or an IT helper, that ends up being the way in.
The difference is that a small business rarely has the staff or budget to recover from a serious attack the way a national institution can. The Library's systems were down for a long time, even with considerable resources. For a small firm, losing access to email, bookings or customer records for even a few days can do lasting damage.
What an outside check can and can't see
It's worth being honest about this. An external scan of your domain can't see your passwords, and it can't tell whether MFA is switched on for your accounts. Those are things only you can check from the inside.
What an outside check can do is spot some of the public-facing signs of a neglected door: missing browser security settings, out-of-date configurations, and services that show more about themselves than they should. Those signs don't prove there's a problem, but they're often a hint that something hasn't been looked at in a while.
Where do you stand?
The British Library deserves real credit for sharing its lessons so openly, so the rest of us don't have to learn them the hard way. The takeaway is simple: it's usually the forgotten exception, not the main front door, that causes the trouble.
Tidy Cyber's free check gives you a plain-English view of what your business looks like from the outside: your website security, email protection, certificate and domain basics. It won't replace a look at your own logins, but it's a quick, jargon-free way to see whether anything public-facing has been left behind.