Ransomware has knocked the website, Wi-Fi, checkout machines and other digital services offline at all 66 Queens Public Library branches in New York City. As of Thursday morning, Nov. 5, those services were still down, and no gang has claimed the attack. The branches stayed open, but the tools most patrons use to borrow, renew and get online have gone dark.

What happened in the Queens Public Library ransomware attack

The library system first reported a systemwide outage on Wednesday, Nov. 4. NY1 reported that the outage covered the website and app, checkout and return machines, renewals, on-site computers and free Wi-Fi at all 66 branches.

The library warned of outages that Wednesday afternoon and confirmed a ransomware attack hours later. The Record reported that an encryption attack by a gang had shut down many of the digital services. The same outlet said the system serves a borough of 2.3 million residents, a reminder of how many people depend on it for free connectivity and public computers.

Some aggregator rewrites have said only three branches were affected. The 66-branch figure appears consistently in the primary reports, so the three-branch version looks like an error unless the library says otherwise.

Which Queens Public Library services are still down

Based on the library's outage reports and coverage from NY1, The Register and Gothamist, these are the services listed as disrupted:

  • Website and mobile app
  • Checkout and return machines
  • Book renewals
  • On-site public computers
  • Free public Wi-Fi
  • Digital media services

The Register reported that the disruption hit public Wi-Fi, the mobile app and digital media services, and that all locations remained open. For many New Yorkers, these losses are practical. Patrons who depend on free Wi-Fi and public computers for job applications, school assignments or government forms have lost that option for now.

As of Thursday morning, the services were still unavailable, according to a statement from president and CEO Dennis Walcott. In that statement he said, "We ask for the public's patience and understanding as we manage this challenge." No restoration timeline has been published, according to WISEvoter.

The Register also quoted a library warning: "It will take some time before the library's network and systems are restored." That line is the most candid signal so far that recovery will be slow.

Late fines are not being charged on borrowed materials during the outage, according to NY1. That is the one concrete accommodation patrons can count on right now.

Why public libraries keep getting hit by ransomware

Public libraries have become a repeat target. The Record reported that gangs have caused significant damage to dozens of libraries worldwide, including Seattle Public Library.

The British Library's 2023 attack, attributed to the Rhysida group, destroyed systems, and the library refused a 20 Bitcoin ransom demand. Recovery was expected to run into 2026, according to reporting by The Record and The Register.

Another case in Washington State shows the data side of the problem. A 2024-2025 ransomware attack on the Pierce County Library System exposed information on more than 340,000 people, The Record reported.

Libraries are attractive targets for a simple reason. They run public-facing systems that must stay open to everyone, from self-checkout kiosks to guest Wi-Fi, and they hold account records for large numbers of cardholders. An attacker who locks those systems creates pressure on the institution even without a large payout.

The Register noted that publicly funded institutions rarely produce large ransom payouts, which is one reason the motive here is unclear. A city library is an unusual choice for a gang that wants quick money. That gap makes the next few announcements important.

What remains unknown about the attackers and the data

No ransomware group had claimed responsibility as of Thursday evening, The Record reported. Gothamist reported that Walcott said the investigation is ongoing and that it is not yet clear who is behind the attack, why the library was targeted or whether users' data was exposed.

The NYPD said it was "aware of a cybersecurity incident impacting Queens Public Library computer systems" and is working with the library and the FBI on the investigation and recovery, according to NY1. Federal involvement suggests investigators see the case as more than a local outage.

Data is the most important open question. The library has said it is still determining the impact on its systems, data and operations. Until it confirms what was taken, patrons should treat any claim about their personal information as unverified.

Vendor breaches can also grow large quickly. SecurityWeek reported that a Frontline Education breach involving K-12 software is being reported at more than 1.3 million people. Public-sector data exposures have followed a similar pattern, as seen when a hacktivist group posted a searchable database of 41,000 DHS staff records and when a Florida student financial aid breach may expose 4.9 million people.

What Queens Public Library patrons should do now

The steps below are general precautions, not guidance from the library.

  • Check the library's official channels before visiting, since branches are open but many services are not.
  • Treat unexpected emails, texts or calls that claim to come from the library as suspicious, especially requests for passwords or payment details.
  • Watch for a formal data-breach notice in the coming weeks, and confirm it came from the library before acting on it.
  • If you reuse your library password on other sites, change it now and give each site a unique password, ideally stored in a password manager.

What to watch next in the Queens library attack

Four signals will show where this case is heading. The first is the restoration timeline, which has not been published, and the library's own warning suggests the network and systems will take time to rebuild. The second is a group claim, which would give investigators a name and could reveal whether data was stolen.

The third is a formal confirmation of whether personal information was taken. The fourth is whether officials connect this attack to a wider campaign against public institutions, which remains unknown.

The branches have stayed open, so the damage falls mostly on the digital services people rely on when they cannot reach a desk. Without a published timeline, patrons should plan for the outage to last beyond the week. The library's next statement will show whether restoration is on track or whether officials face a larger extortion fight.