Queens Library Ransomware Attack: What Is Back, What Is Still Down, and the Recovery Plan Every Business Needs

Queens Public Library in New York City is still recovering from a ransomware attack. Starting Wednesday, November 4, 2026, it took down the library's website, mobile app, public computers and other systems across all 66 branches. Any business can learn from it, because the library is going through the test your own plan should pass: the doors stayed open and lending carried on, systems came back one at a time, and days later the website customers use is still offline.

What happened at Queens Public Library

The library first reported a network outage across the whole system on the afternoon of Wednesday, November 4. Hours later it confirmed that ransomware was the cause, according to The Record. By Thursday morning, November 5, the website, the app, check-out and return machines, renewals, on-site computers and Wi-Fi were all unavailable, according to a statement from president and CEO Dennis Walcott reported by NY1.

The NYPD told NY1 it knows about a cybersecurity incident at the library and is working with the library and the FBI on the investigation and recovery. Walcott said the library is also working with federal partners, City Hall and cybersecurity experts. He said it is still working out the full impact on its systems, data and operations.

Queens Library outage: what is back and what is still down

As of November 10, 2026, the library's own outage updates page lists the following:

The page has no date stamp, so treat this list as a snapshot. Some virtual and in-person programs may also be affected, and the library asks patrons to check with their local branch.

What is confirmed and what is not

The library confirms three things: the outage is the result of a ransomware attack, it affects all locations, and the branches are open. The NYPD confirms it is working with the library and the FBI.

Still not known as of November 10:

• Who did it. The Record reported that no ransomware group had claimed the attack as of Thursday evening, November 5. We found no later claim confirmed by the library or by law enforcement.
• Whether data was taken. The library has not said whether patron or staff information was stolen. Its outage page does not mention accounts, passwords or personal data.
• Whether a ransom was demanded or paid. No statement we found says.
• How the attackers got in. The library has not said.
• When the website and app return. Library officials told NY1 they did not know when services would be back.

Are you a Queens library cardholder who used the same PIN or password for your library account on other sites? While the data question is open, change it on those other sites as a precaution.

Ransomware recovery: what the order of repairs tells a business

Look at what came back first: Wi-Fi and the check-out machines, the things people use the moment they walk in. Public computers came next, at seven locations. The website, the app and digital media are still down. The library has not explained its priorities, so we will not guess at its reasons. Even so, the pattern is a useful reminder. Recovery happens in pieces, and you either decide the order ahead of time or you decide it in a panic.

Four things stand out for a company network:

1. The doors stayed open. Patrons could still borrow and return materials. If your systems were encrypted tomorrow, could you still take an order, run a job or answer a customer? Paper fallbacks for your three most important processes are cheap to write and pay for themselves on the day you need them.
2. The website is among the last things back. For many businesses, the website is where customers check hours, place orders and log in. If it runs on the same network or the same accounts as everything else, one incident takes out your operations and also the way you would tell customers about it.
3. There was somewhere to post updates. With the main site down, the library pointed its web address to a separate outage page, backed up by its social media accounts and a help phone line. Decide now where your updates would go if your own website and email stopped working.
4. A customer decision was made quickly. The library stopped charging late fines during the outage. Decide ahead of time what you would waive, extend or refund, so nobody has to argue about it mid-crisis.

In the first hour, a lot depends on knowing exactly who to call. We wrote about that in When Your Systems Go Down, Who Do You Call?. Nobody knows yet how attackers got into the library. In general, the doors to close are internet-facing systems that are behind on updates and logins without a second factor. Who Is Patching the Software That Runs Your Business? covers the update side.

Ransomware checklist: what to do this week

Ransomware attack questions people are asking

Was Queens Public Library hacked?

Yes. The library says its network outage is the result of a ransomware attack, and the NYPD says it is working with the library and the FBI.

Is Queens Library open?

Yes. All branches are open as scheduled, and you can borrow and return materials. As of November 10, 2026, renewals, the website, the app and digital media services were still unavailable.

Was my data stolen in the Queens Library ransomware attack?

Nobody knows yet. The library has not said whether any patron or staff data was taken.

Who is behind the Queens Library ransomware attack?

Not known. The Record reported that no group had claimed it as of November 5, and the library has not named one.

Will I be charged late fees at Queens Library?

No. The library says it is not charging late fines on borrowed materials during the outage.

What should a business do first if ransomware hits?

Cut the affected machines off from the network, call your IT provider and your insurer, and follow your written plan. CISA's #StopRansomware Guide covers both prevention and response, and it is worth reading before you need it.

The bigger lesson

Queens Public Library kept its doors open and kept lending while its systems were encrypted, and it is bringing services back one at a time. That is what surviving a ransomware attack looks like. Whether a business keeps going or simply stops gets decided before the attack: a backup the attackers cannot reach, a restore you have actually tested, a plan on paper and a way to reach customers when your own systems are dark.

For help hardening your network and building a recovery plan, see security hardening or request a quote.

Get security alerts by email, with the free checklist, on our security alerts page.

Sources: Queens Public Library network outage updates; NY1; The Record; CISA #StopRansomware Guide.