[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fo1TnyDVZBrGF4GLfS6o2vvfP-tbUAbtSBZLIZIsqy-g":3},{"article":4,"iocs":47,"watch_terms":48,"solutions":49,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"5a37fed8-a8e4-4502-ae61-07c23b2f591c","Queens Public Library says ransomware attack disrupted Wi-Fi, on-site computers","queens-public-library-says-ransomware-attack-disrupted-wi-fi-on-site-computers-fd9815","The library system, which has 66 branches serving the borough’s 2.3 million residents, published multiple alerts on Wednesday confirming that the disruption was caused by a ransomware attack.","The Queens Public Library system has confirmed it was hit by a ransomware attack, leading to the encryption of its systems and the shutdown of various digital services. This includes on-site computers, check-out machines, Wi-Fi access, and its mobile app, impacting operations across its 66 branches. The library is working with law enforcement and cybersecurity experts to resolve the issue.","Queens Public Library confirms ransomware attack disrupted Wi-Fi and on-site computers.","https:\u002F\u002Ftherecord.media\u002Fqueens-library-ransomware-causes-disruptions","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002Fqueens_library_5e385910af.jpg","2026-11-05T22:08:00+00:00","2026-11-05T23:00:07.356221+00:00",7,[17,20,22,24],{"name":18,"type":19},"Wi-Fi","product",{"name":21,"type":19},"mobile app",{"name":23,"type":19},"on-site computers",{"name":25,"type":19},"check-out and return machines","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":26,"icon":28,"name":29,"slug":30},null,"Ransomware","ransomware",[32,37,42],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":43},{"id":44,"icon":28,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,23,25],{"controls":50,"vendors":138},[51,80,109],{"slug":52,"name":53,"problem":54,"products":55},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":81,"name":82,"problem":83,"products":84},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"slug":110,"name":111,"problem":112,"products":113},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","incident-response","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":151},"ransomware-shuts-down-queens-public-library-across-66-branches","Ransomware Shuts Down Queens Public Library Across 66 Branches","The Queens Public Library suffered a ransomware attack that encrypted systems and disrupted critical services — including Wi-Fi, check-out machines, and its mobile app — across all 66 branches simultaneously. This scale of disruption suggests a lack of network segmentation, allowing the ransomware to propagate freely across the entire library network. The incident also highlights inadequate backup and recovery preparedness, as encrypted systems rendered operational services unavailable rather than being rapidly restored. Public institutions holding community data and providing essential services are high-value targets precisely because downtime pressure can incentivize ransom payment. This matters because ransomware attacks on public infrastructure erode community trust and can expose sensitive patron data.",[144,145,146,147,148,149,150],"CIS Control 11: Data Recovery","CIS Control 17: Incident Response Management","CIS Control 14: Security Awareness and Skills Training","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":152,"CIS Control 11: Data Recovery":153,"NIST SP 800-53 SI-2: Flaw Remediation":154,"CIS Control 17: Incident Response Management":155,"CIS Control 14: Security Awareness and Skills Training":156,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":157,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":158},"NIS2 requires essential and important entities to implement incident handling measures including business continuity and backup management, directly addressing the library's failure to maintain resilient operations during the ransomware event.","The widespread service outage across all 66 branches indicates an absence of tested, immutable backup procedures; CIS Control 11 mandates regular, verified backups that would have enabled rapid restoration and reduced ransom leverage.","Ransomware frequently exploits unpatched vulnerabilities; a disciplined flaw remediation process mandated by SI-2 would reduce the attack surface available to threat actors targeting public-sector networks.","The library's reliance on external law enforcement and cybersecurity experts after the fact suggests no pre-established incident response plan; CIS Control 17 requires a documented, rehearsed IR plan to contain and recover from ransomware efficiently.","Ransomware commonly enters via phishing or staff error; CIS Control 14 requires role-based security training that would reduce the likelihood of an employee inadvertently enabling the initial intrusion.","This control requires timely identification and remediation of technical vulnerabilities, which if followed would have reduced the exploitable weaknesses that enabled ransomware to take hold across library systems.","Ransomware's ability to encrypt systems across all branches suggests overly permissive access controls; enforcing least-privilege and multi-factor authentication would have limited the blast radius of the attack."]