Private data stolen from the British Library in a recent ransomware attack is currently listed for sale on a dark web auction site for $750,000 in bitcoin.
The data, which includes passport details and HMRC employment documents, was stolen in late October and is reportedly being used to blackmail the institution.
According to The Register, the ransomware group behind the attack, Rhysida, has already received a starting bid of 20 bitcoin, worth roughly $745,000. The auction is set to end on November 27.
TechCrunch also claims that Rhysida threatened to publish the data unless a ransom demand from the British Library was paid.
However, the group apparently changed tack and has now listed the data through its auction. An ESET global cybersecurity advisor told The Register that Rhysida has likely “not been paid the ransom,” and “are now pushing out the next phase of the attack by threatening the release of data.”
We’re continuing to experience a major technology outage as a result of a cyber-attack, affecting our website, online systems and services, and some onsite services too. We anticipate restoring many services in the next few weeks, but some disruption may persist for longer.… pic.twitter.com/Wdj7VfkWXa
— British Library (@britishlibrary) November 20, 2023
“With just 7 days on the clock, seize the opportunity to bid on exclusive, unique, and impressive data,” Rhysida’s listing says. “Open your wallets and be ready to buy exclusive data. We sell only to one hand, no reselling, you will be the only owner.”
The British Library first revealed the outages in late October before confirming it was the victim of a ransomware attack on November 14. The attack caused several major technical outages, including the incapacitation of the library’s website. The site is currently still down and the library is posting updates on X (formerly Twitter).
This week, it claimed, “We have no evidence that data of our users has been compromised.” It said anyone with a British Library account that uses a password they share with other accounts should change that password across the board.
