Overview
Queens Public Library (QPL) in New York City confirmed on Wednesday, November 4, 2026, that a ransomware attack has disrupted its systems. The library system has 66 branches serving the borough's roughly 2.3 million residents.
What Is Affected
Per reporting from NY1, The Register and Gothamist, the following are down:
- The library website and mobile app
- On-site public computers
- Public Wi-Fi
- Self-service check-out and return machines
- Digital media services
- Online renewals (the library says patrons will not be charged late fines)
All branches remain open on their regular schedule. Patrons can still borrow and return books in person, though some virtual and in-person programs may be disrupted.
Response
The NYPD confirmed a cybersecurity incident and is working with the library and the FBI on investigation and recovery. QPL president and CEO Dennis Walcott said on Thursday morning that services were still down, and the library has warned it will take time to restore its network and systems.
What We Don't Know
- Who is responsible. No ransomware group has claimed the attack.
- Whether data was stolen. The library has not said whether patron or staff data was exposed.
- When systems will return. No restoration timeline has been given.
Some coverage has compared the incident to the British Library ransomware attack, which caused a long recovery.
Takeaways for Defenders
Public libraries and other local-government bodies run lean IT teams but offer public Wi-Fi and shared computers, which widens the attack surface.
- Segment public networks (Wi-Fi, patron PCs) from staff and back-office systems.
- Keep offline, tested backups, and rehearse a restore, since recovery rather than the initial attack is what drives long outages.
- Prepare manual fallback procedures, as QPL's in-person checkout shows, so core services continue while systems are rebuilt.
- Have a disclosure plan for the point at which investigators determine whether personal data was taken.