A Cultural Catastrophe: How ISO 27001 Could Have Protected the British Library

In what’s been described as one of the most devastating cyberattacks on a UK public institution, the British Library suffered a crippling ransomware attack in October 2023, which is still having major consequences deep into 2025. The attacker? A relatively new but dangerous ransomware gang called Rhysida - known for “double extortion” tactics: locking down systems while simultaneously leaking stolen data if ransom demands aren’t met.

By July 2025, the full scope of the breach had become painfully clear. Over 600 gigabytes of internal data - including HR records, payroll files, procurement information, staff passport scans, and contracts with private sector partners - was leaked and made publicly accessible via the dark web. Even donor records and personal details of individuals who had supported the Library financially were exposed. Rhysida reportedly demanded a seven-figure ransom, which the Library refused to pay - in line with government policy.

The aftermath was catastrophic:

• The Library’s digital catalogues, website, and internal systems were offline for months.

• Staff were forced to revert to pen-and-paper processes.

• Public services were disrupted, including vital research tools relied upon by students and academics.

• The Library spent over £7 million on recovery efforts by mid-2025.

• The breach triggered investigations, public scrutiny, and reputational damage for one of the UK’s most respected institutions.

This wasn’t just a one-off cyber incident. It was a systemic failure of digital risk management - and a textbook example of where ISO 27001:2022 could have made all the difference.

What Went Wrong?

While technical specifics are still under investigation, several failures are widely understood:

• Lack of Zero Trust or network segmentation: Once inside, attackers were able to move laterally through the network and access highly sensitive files across departments.

• No early detection systems: The intrusion was not immediately detected, allowing time for Rhysida to exfiltrate and encrypt data.

• Inadequate incident response planning: Recovery took months - a sign that business continuity and disaster recovery plans were either insufficient or poorly tested.

• Insufficient data classification and encryption: Highly sensitive information was stored unencrypted and easily published.

• Weakness in supply chain vetting: Some of the breached files included details of third-party suppliers and private donors, raising questions about how external data was being secured.

How ISO 27001:2022 Could Have Prevented or Minimised the Damage

ISO 27001 is not just a technical standard. It’s a comprehensive framework for information security management - combining technical controls with governance, culture, and continual improvement. Here's how it applies directly to the British Library attack:

1. Risk Assessment and Threat Awareness ISO 27001 requires you to identify threats like ransomware, assess their likelihood and impact, and treat the risks with proportionate controls. For an organisation holding valuable cultural and personal data, ransomware should have been a top priority in their risk register.

2. Network Segmentation and Least Privilege Under ISO 27001’s Annex A controls (e.g., A.8.1, A.8.16, A.8.34), segmentation and access control would limit lateral movement. Even if attackers gained access, they’d be restricted to low-sensitivity areas - preventing them from pulling 600GB of critical data.

3. Supplier and Donor Data Protection (A.5.19 & A.5.21) ISO 27001 requires organisations to manage third-party data with care. This includes contractual controls, encryption, and breach response protocols. The exposure of donor and partner data could have been prevented - or at least mitigated.

4. Business Continuity and Incident Response (Clause 6.1 & Annex A.5.29) The drawn-out recovery period indicates weak disaster planning. ISO 27001 mandates tested recovery plans and defined roles for incident handling. Organisations certified to the standard are more likely to recover in days, not months.

5. Monitoring, Detection and Logging (A.8.16) Early detection is key. ISO 27001-certified environments typically implement SIEM tools and anomaly detection systems that flag suspicious activity quickly - well before full-scale encryption or data exfiltration takes place.

Why This Should Alarm Every UK Organisation

The British Library is a public institution with historical prestige, not a tech giant. And yet, its breach shows that no organisation is too big or too traditional to be targeted. Worse still - as seen in this case - a lack of preparedness can paralyse operations and cause irreparable reputational harm.

With ransomware-as-a-service models expanding and AI accelerating cybercriminal capabilities, ISO 27001 is no longer a “nice to have.” It’s a necessity.

Don’t Wait Until It’s You

ISO 27001:2022 gives you a practical, proven path to protecting what matters most - your information, your operations, and your reputation. Whether you're a library, law firm, manufacturer, or charity, the risks are the same - and the solution is available.

At AAA Certification Ltd, we make the certification journey simple, affordable, and tailored to your organisation’s needs.

Don't wait any longer. Sign up to a Certification Audit with AAA and take the first step towards achieving ISO 27001 certification.