how it happened
- whoRhysidaransomware group
- the gapno MFArisk logged, under-weighted
- thenservers and files~600GB exfiltrated, logs deleted
- the resultlibrary offlinemonths of recovery
what everyone assumed
When you roll out MFA, the project has a scope, and a few systems sit outside it for reasons that are real on the day: practicality, cost, a service that other work depends on. The team did the responsible thing, recording the absence of MFA on those domains as a mitigated risk. The assumption inside that decision is the ordinary one: the systems behind MFA are the ones that matter, and a documented exception is a managed exception.
what happened
The exception sat in the risk register, true and under-weighted. The Library’s own review later put it carefully: the missing MFA was identified and classed as a mitigated risk, but the consequences of that gap were under-appraised. Around it sat an unusually diverse and complex estate with a large number of legacy systems, which would later let an intruder move further than a more modern network would have allowed. The risk was on the page the whole time. What it would actually cost was not.
step by step
- a remote-access server without MFAListed in the risk register as a mitigated risk, with its consequences under-appraised.the assumption breaks here
- October 2023Rhysida gets in, most likely through that serverA complex estate with many legacy systems lets them move far.
- data taken, servers destroyedRoughly 600GB exfiltrated, close to half a million files copied, logs deleted on the way out.
- March 2024the Library publishes its own lessonsIt names the entry point and the under-appraised exception.
how it surfaced
In October 2023 the Rhysida group is believed to have entered through that remote-access server, the most likely point of compromise being a server without MFA. They exfiltrated roughly 600GB of data, copied close to half a million files, destroyed servers, and deleted logs on the way out. The Library chose full transparency and published “Learning Lessons from the Cyber-Attack” in March 2024, naming the entry point and the under-appraised exception in its own words.
A risk you have documented is not the same as a risk you have closed, and “mitigated” can quietly mean “written down and lived with.” The exception the rollout left behind was the one the attacker used.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersAn attacker finds that one door and walks through it.what it costs youSystems are wiped, data is published, and rebuilding takes far longer than fixing the server would have.
- or it goes like thisit happened23andMe, 2023howLeaked passwords are tried against customer accounts until some open.what leavespersonal details of customers and their contactswho ends up with itfraudsters
- or it goes like thisit happenedThe Snowflake wave, 2024howAn old password opens a data store that never required a second step.what leavesthe whole database in one downloadwho ends up with itan extortion group
sources
your turn
what you can do about it
this week
Pull that list of MFA exceptions and read it as an attacker would, asking which one reaches the most once it is through.
Your MFA rollout had a scope too, and somewhere there is a list of what fell outside it, the legacy box, the partner connection, the system that was too disruptive to touch that quarter. The British Library's gap was a single line that everyone had already seen.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →