British Museum hit by alleged IT attack by ex-worker

[6Foot2]

When an IT worker goes rogue.

 

Link: British Museum hit by alleged IT attack by ex-worker - BBC News

 

The British Museum has been forced to partially close to visitors after a former employee allegedly shut down some of its IT network.

 

The contractor, who was recently dismissed from the central London museum, got into the building and accessed the systems before being arrested.

 

It led to some galleries being closed on Friday, along with temporary exhibitions that remain closed.

 

The museum said capacity was limited for this weekend, with members and those who already hold tickets given priority.

 

A British Museum spokesman told the BBC: "An IT contractor who was dismissed last week trespassed into the museum and shut down several of our systems.

 

"Police attended and he was arrested at the scene.

 

"We are working hard to get the museum back to being fully operational but with regret our temporary exhibitions have been closed today and will remain so over the weekend – ticket holders have been alerted and refunds offered."

 

Customers who already hold tickets for this weekend have been contacted ahead of their visit.

 

The British Museum - which holds items including the Rosetta Stone, the Anglo-Saxon ship burial at Sutton Hoo and the contested Parthenon Sculptures - sees millions of people go through its doors each year to see the permanent collections and exhibitions.

 

Last year it was named the top UK visitor attraction, having had 5,820,860 visitors in 2023.

 

There are currently three temporary exhibitions, including Silk Roads and Picasso: Printmaker.

 

The museum said it apologised for any inconvenience and asked customers to contact its box office to reschedule their visits or have tickets refunded.

 

The Metropolitan Police has been contacted for comment.

[Ditto]

You've got to wonder what accounts and passwords were not secured after the former employee was dismissed.

[MatthewL]

Sounds like some processes are missing from the leavers process here!

[southhamster]

There's an interesting (but very long) article here about the huge problems at the British Museum, including lack of money and systematic theft of items.

I guess this lack of procedures, policies and their proper execution is just part of the ongoing troubles.

 

https://www.theguardian.com/culture/2025/jan/16/the-ghosts-are-everywhere-can-the-british-museum-survive-its-omni-crisis

* I am retired so am allowed time to read it all!

[Dos_Box]

Tried to get in this afternoon. Joined the queue and were told that unless you had a ticket you couldn't get in, apparently down to the IT 'issue'.

We went to the V&A instead.

[Ditto]

Tried to get in this afternoon. Joined the queue and were told that unless you had a ticket you couldn't get in, apparently down to the IT 'issue'.

We went to the V&A instead.

 

Their loss - I'm sure you could have given them some appropriate Edugeek advice

[smurfomatic]

Their loss - I'm sure you could have given them some appropriate Edugeek advice

 

"We can't let you in, sir"

 

"But dammit, I'm an Edugeeker!"

 

"We've been expecting you, right this way..."

[robintech]

The British Library one had a good report when theirs happened, hope the British Museum do the same

 

https://blogs.bl.uk/living-knowledge/2024/03/learning-lessons-from-the-cyber-attack.html

[mavhc]

British Library's main problem was when they got given a collection of books it also came with its own IT cataloguing system, so they had many different out of date systems to run.

 

It would be pretty hard to effectively scrub an evil IT admin from the network, who knows what they have set up in a ceiling somewhere, or a vm, or just a program running on a random desktop somewhere in the building

[TechMonkey]

You've got to wonder what accounts and passwords were not secured after the former employee was dismissed.

 

I bet legacy shared credentials. Such a menace but very hard sometimes to get away from. Think of your switches? Do you put a separate user on each of them?

[akidosaint]

You've got to wonder what accounts and passwords were not secured after the former employee was dismissed.

 

The fact they were able to (assumption) get to a back office to in 1st place is the bigger concern. If they still had an id card why was it not disabled\retrieved immediately once termination issued. and If they didn't have the card someone must have let them in why were staff not informed of this.

 

This potentially could have been stopped with a bit of common (none IT) sense.

[FN-GM]

Think of your switches? Do you put a separate user on each of them?

 

Nope. Centrally managed authentication.

[MatthewL]

IT are one of them trusted people, often those below are not kept in the loop when key people leave so IT person may of not even needed ID, x on the door says hi, forgot my card can you let me in yeah no probelm siuation.

 

Very simimilar in other large orginisations seen it myself, bigger the orginisation the harder it is to manage and you need a good team to keep an eye out for any threats.

[PotNoodleTech]

I'd wager 50p that the contractors account(s) were not disabled on his last day at 5pm on friday.

[mavhc]

"There are currently three temporary exhibitions, including Silk Roads and Picasso: Printmaker." just tell us all 3 at that point

[NegativeKillDeath]

I'd wager 50p that the contractors account(s) were not disabled on his last day at 5pm on friday.

 

Or he was dismissed before his contract end date and the off boarding processes hadn't kicked in yet.

[Davit2005]

If he was

dismissed

you wonder why his account was not disabled immediately, lol.

[jmak]

"There are currently three temporary exhibitions, including Silk Roads and Picasso: Printmaker." just tell us all 3 at that point

Maybe they haven't actually thought of the third yet - it's just optimism...

[Andrew_C]

Haven't stolen it from a colony yet?