# Queens Public Library Ransomware Attack Disrupts Wi-Fi, On-Site Computers and Digital Services

> Queens Public Library (66 branches, 2.3 million residents) reported a ransomware attack on Wednesday, November 4, 2026 that disrupted on-site computers, check-out/return machines, Wi-Fi, digital media services and the mobile app. No ransomware gang had claimed the attack as of Thursday evening, and the library says it is working with law enforcement and cybersecurity experts.

- **Published:** 2026-11-05T22:22:36Z
- **Last reviewed:** 2026-11-06T05:59:01.087Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5350
- **ID:** TL-2026-5350
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 10

## Description

Queens Public Library (QPL), one of the largest public library systems in the United States, disclosed that it was hit by a ransomware attack on Wednesday, November 4, 2026. According to reporting by The Record from Recorded Future News (published 2026-11-05), the incident disrupted on-site computers, check-out and return machines, Wi-Fi access, digital media services and the QPL mobile app. QPL operates 66 branches serving roughly 2.3 million residents, holds more than 5 million books in 50 languages, and also runs learning centers in public housing complexes and several mobile libraries.

QPL stated that all locations remain open as scheduled, although certain virtual and in-person programs may be impacted, and that it is working closely with law enforcement and cybersecurity experts. NYC officials did not comment in the source article. As of Thursday evening (2026-11-05) no ransomware group had claimed responsibility, no leak-site listing was reported, and no data theft, ransom demand, initial access vector, malware family or technical indicators have been made public.

The incident follows a pattern of ransomware against public library systems: Seattle Public Library (May 2024; wireless network, staff and patron computers and the online catalog taken offline), Toronto Public Library and the British Library (2023; the British Library suffered HR data theft and Toronto needed months to recover), and Pierce County Library System in Washington (April 2025, INC ransomware, more than 340,000 people notified). Libraries are attractive because outages hit public-facing services and e-book/digital lending, which gives operators leverage.

ANALYST NOTE ON EVIDENCE: Only file-encryption ransomware impact (T1486) and the resulting service disruption are confirmed by sources. The initial-access and related technique mappings in this record are UNCONFIRMED, class-level hunting hypotheses drawn from common ransomware intrusion paths and must not be read as findings about this incident. No IOCs exist yet in public sources; the IOC list contains the victim, affected services, precedent incidents and precedent ransomware families (clearly labelled as not attributed to this incident). This record should be updated when QPL, law enforcement or a leak site provides attribution or technical details.

## MITRE ATT&CK

- T1489 Service Stop
- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1685 Disable or Modify Tools
- T1486 Data Encrypted for Impact

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5350 Ransomware Recovery Inhibition (Shadow Copy / Backup Deletion) Preceding Encryption** (`TL-2026-5350-SPL-001`)

Behaviour-first hunt for the pre-encryption step common to ransomware that ends in Data Encrypted for Impact (T1486): deletion of Volume Shadow Copies, backup catalogs and boot recovery via vssadmin, wmic, diskshadow, wbadmin and bcdedit (T1490). Queens Public Library (TL-2026-5350) confirmed only file-encryption impact; no family is attributed, so this is a class-level rule that also covers the precedent library-sector families (INC Ransom, Black Basta). Fires per host/user/parent so responders can isolate the host before encryption completes.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1490, T1486
- **Data sources:** sysmon, windows_process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ((Image="*vssadmin.exe" CommandLine="*delete*" CommandLine="*shadows*") OR (Image="*wmic.exe" CommandLine="*shadowcopy*" CommandLine="*delete*") OR (Image="*diskshadow.exe" CommandLine="*delete*" CommandLine="*shadows*") OR (Image="*wbadmin.exe" CommandLine="*delete*" (CommandLine="*catalog*" OR CommandLine="*backup*")) OR (Image="*bcdedit.exe" (CommandLine="*recoveryenabled*no*" OR CommandLine="*bootstatuspolicy*ignoreallfailures*")))
| eval technique="T1490 recovery inhibition preceding T1486 (TL-2026-5350)"
| stats count AS events dc(CommandLine) AS distinct_cmds values(CommandLine) AS commands min(_time) AS first_seen max(_time) AS last_seen BY host User ParentImage technique
| where events>=1
| convert ctime(first_seen) ctime(last_seen)
| sort - last_seen
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has_all ("delete", "shadows"))
    or (FileName =~ "wmic.exe" and ProcessCommandLine has_all ("shadowcopy", "delete"))
    or (FileName =~ "diskshadow.exe" and ProcessCommandLine has_all ("delete", "shadows"))
    or (FileName =~ "wbadmin.exe" and ProcessCommandLine has "delete" and ProcessCommandLine has_any ("catalog", "backup"))
    or (FileName =~ "bcdedit.exe" and (ProcessCommandLine has_all ("recoveryenabled", "no") or ProcessCommandLine has_all ("bootstatuspolicy", "ignoreallfailures")))
| summarize Events=count(), Commands=make_set(ProcessCommandLine, 10), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, AccountName, InitiatingProcessFileName
| order by LastSeen desc
```

### Sigma

```yaml
title: TL-2026-5350 Ransomware Recovery Inhibition via Shadow Copy and Backup Deletion
id: 7c1f3a52-9d84-4e0b-b6a7-2f5e8c14d9a1
status: experimental
description: Detects deletion of shadow copies, backup catalogs and boot recovery settings that precedes ransomware file encryption (T1490, T1486). Class-level hunt for TL-2026-5350 (Queens Public Library ransomware).
references:
  - https://therecord.media/queens-library-ransomware-causes-disruptions
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
  - attack.impact
  - attack.t1490
  - attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains|all:
      - 'delete'
      - 'shadows'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains|all:
      - 'shadowcopy'
      - 'delete'
  selection_diskshadow:
    Image|endswith: '\diskshadow.exe'
    CommandLine|contains|all:
      - 'delete'
      - 'shadows'
  selection_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains:
      - 'delete catalog'
      - 'delete backup'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  condition: 1 of selection_*
falsepositives:
  - Backup or storage administrators pruning shadow copies during maintenance
  - Imaging and deployment tooling that resets boot configuration
level: high
```

**Known false positives:**

- Backup or storage administrators deleting shadow copies during scheduled maintenance
- OS imaging or deployment tooling that resets bcdedit boot recovery settings

**Tuning notes:** Change index=windows to the index that holds Sysmon data in your environment. Allowlist known backup-server hosts and service accounts by host/User. Keep ungated on library staff workstations, kiosks and public computers, where legitimate use is near zero. Raise to a paging alert when two or more distinct commands fire on one host within 10 minutes.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5350 Defender for Endpoint: Shadow Copy and Backup Deletion Before Encryption (locked: unlock with TL Creds)
- TL-2026-5350 Defender for Endpoint: Security Tooling Tamper and Service Stop Burst (locked: unlock with TL Creds)
- TL-2026-5350 Phishing Foothold: Office or Mail Client Spawning Script Interpreter (T1566) (locked: unlock with TL Creds)
- TL-2026-5350 Sigma: Ransomware Recovery Inhibition and Impact Precursors (locked: unlock with TL Creds)
- TL-2026-5350 Sigma: Service Stop and Security Tooling Impairment Before Encryption (locked: unlock with TL Creds)
- TL-2026-5350 Sigma: Web Server or Remote-Access Process Spawning Shell (T1190) (locked: unlock with TL Creds)
- TL-2026-5350 Security Tooling Tamper and Backup/Database Service Stop (T1562, T1489) (locked: unlock with TL Creds)
- TL-2026-5350 Valid Account Compromise: Failed-Logon Burst Followed by Remote Logon (T1078) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Queens Public Library says ransomware attack disrupted Wi-Fi, on-site computers](https://therecord.media/queens-library-ransomware-causes-disruptions)
- [Seattle Public Library ransomware attack knocks out systems](https://therecord.media/ransomware-attack-seattle-knocks-out)
- [Over 340,000 impacted by Washington state library hack (Pierce County, INC ransomware)](https://therecord.media/over-340000-impacted-washington-state-library-hack)
- [Black Basta ransomware attack behind Toronto Public Library outages (SC Media)](https://www.scworld.com/brief/black-basta-ransomware-attack-behind-toronto-public-library-outages)
- [Ransomware attack behind Toronto Public Library service interruption (CBC)](https://amp.cbc.ca/news/canada/toronto/ransomware-toronto-public-library-1.7021097)
- [Even public libraries aren't safe from ransomware, as Canada's biggest is hit (TechRadar)](https://www.techradar.com/pro/security/even-public-libraries-arent-safe-from-ransomware-as-torontos-is-hit)
- [British Library: ongoing outage caused by ransomware attack (BleepingComputer)](https://www.bleepingcomputer.com/news/security/british-library-ongoing-outage-caused-by-ransomware-attack/)
- [British Library confirms ransomware attack caused outages (Dark Reading)](https://www.darkreading.com/cyberattacks-data-breaches/british-library-confirms-ransomware-attack-caused-outages)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5350