‘Sophisticated’ Ransomware Attack Hits Westchester Libraries | #malware | #ransomware | #education | #technology | #infosec

WESTCHESTER COUNTY, NY — Several days after a ransomware attack was detected, officials announced that library cardholders’ personal information was not likely compromised.

The Westchester County Library System confirmed that its network was the target of a ransomware attack last week but said it does not believe that patrons’ personal information was ever at risk.

“The security measures in place were able to prevent the brunt of the attack,” library officials said in a statement. “No patron data was compromised as a result of this attack. Due to the nature of the public computers, they were easier to exploit. Although WLS has removed the most visible elements of the Ransomware and the machines may appear to be usable, we feel it is pertinent to do a full computer restore due to the sophisticated nature of this attack.”

The library said that IT specialists are working to make sure all public machines are safe to use but are leaving most of the public computers offline until it can be confirmed that the public terminals are safe to use.

The Larchmont Public Library said they only recently learned of last week’s security breech.

“The Westchester Library System informed us yesterday that the public internet terminals’ hard drives need to be wiped,” the library told patrons on Friday. “Considering that there are 500 terminals in 38 different libraries the process will take 1 1/2 to 2 weeks.”

Larchmont, Harrison and Mamaroneck public libraries have since notified cardholders that public terminals have been taken offline, but public Wi-Fi remains available. The Lewisboro Library said its terminals would remain unavailable indefinitely, but the library would be providing laptops to use in person at the library or to check out to bring home while the public computers are out of commission.

In July of 2019, the Westchester County Library System took its public computer terminals offline as a security precaution following a similar ransomware attack. There was no evidence that patrons’ sensitive personal information was exposed in the prior hack either.