On Thursday, December 28, 2023, the servers of Gallery Systems, a software company for museums, were encrypted. The company explained that it was a victim of a ransomware attack. BleepingComputer
The company provides “TMS” for managing collections and “eMuseum” for publishing collections online. This encryption caused the online collections of multiple museums to become inaccessible.
It has been reported that some curators who returned from their holidays after the New Year were unable to open TMS. Boston.com (distributed by The New York Times)
Which museums were affected?
In terms of reports, the impact was confirmed at four museums in the United States: the Museum of Fine Arts, Boston; the Rubin Museum of Art in New York; the Crystal Bridges Museum of American Art in Arkansas; and the Frances Lehman Loeb Art Center at Vassar College.
In Ireland, the Arts Council’s collection page went offline. The Irish Times
A spokesperson for the Rubin Museum of Art stated that they noticed the outage starting on December 28. As of the time of interviews after the New Year, TMS had been restored, but eMuseum was still offline. Boston.com (distributed by The New York Times)
At Crystal Bridges, it was reported as of January 4 that eMuseum had been offline for about a week. Artnet News
Meanwhile, the Metropolitan Museum of Art and the Whitney Museum of American Art were not affected because they operate their databases in-house. The Metropolitan Museum demonstrated that even with the same company’s products, the results can differ depending on where they are hosted.
According to BleepingComputer, the company’s clients include over 800 museums. However, the total number of museums that actually went offline could not be confirmed in major reports. BleepingComputer
Notification issued by the company
The notification the company sent to its clients was brief. The text reported by BleepingComputer states the following:
“On Thursday, December 28, 2023, some computers running our software were encrypted, causing them to stop working.” “We will restore data from the last available backup.” (Translated by the author)
The New York Times also obtained the company’s notification. It stated that they had isolated the affected systems and preventively shut down other systems as well. They have brought in external security experts to begin an investigation and have also notified law enforcement agencies.
What caught my attention was the sentence about the backup. It means there is no guarantee that records entered between the last backup and the encryption will be recovered.
As of reports in early January 2024, no claim of responsibility by an attack group has been confirmed. It has also not been disclosed whether data was exfiltrated. The date when all museums were fully restored could not be confirmed from major reports.
When one company goes down, its peers go down together
From here on is my speculation based on public information.
Collection management is highly specialized, and I believe the number of companies providing these services is limited. When one company is attacked, museums that run their services on the same infrastructure of that company can all go offline at once.
It is difficult for individual museums to completely prevent the outage of a vendor solely through their own security measures. While measures like strengthening passwords and implementing multi-factor authentication are important, they alone cannot protect the vendor’s servers. Therefore, preparation is needed to continue essential work even during an outage.
Moreover, it happened at the end of the year. According to The Art Newspaper, the scale of the incident only became clear after staff returned from the holidays. During periods with fewer people, there is a risk that grasping the extent of the damage and convening relevant parties will be delayed. The Art Newspaper
I do not intend to read the Metropolitan Museum of Art case as proof that in-house operation is the correct answer. In-house systems have their own accidents. What can be said is that the moment you decide to outsource, you have entrusted the days you will be offline to the vendor.
What do museum data tell us?
The New York Times lists the following as contents of collection management systems: donor names, loan agreements, provenance records, shipping information, and storage locations.
Professor Erin Thompson of John Jay College of Criminal Justice, who studies art crime, states: ‘The works in a museum have value, but the information about the works is truly priceless’ (translated by the author).
When laid out, the information needed for preliminary research on theft is all there. Which work is being transported, when, from where to where, and where it is stored. A list of donors can also be a clue to finding the owners of works or their associates. However, not all donors are necessarily wealthy individuals who still possess high-value works.
In the reports from January 2024 referenced this time, it cannot be confirmed whether data was exfiltrated. However, when a vendor of the same type is targeted again, there is no guarantee that the damage will be limited to just a service outage.
What the British Library left behind
In the same autumn of 2023, the British Library in the UK suffered from a ransomware attack. On March 8, 2024, the library published a report summarizing the circumstances and lessons learned. British Library
According to the report, they determined it was a major incident on the morning of October 28. However, the attackers had entered the network by the night of October 25 at the latest. The group that claimed responsibility is called Rhysida. Approximately 600GB and just under 500,000 documents were exfiltrated. The library did not pay the ransom.
The first unauthorized access was found on a terminal server installed in February 2020. It was intended for trusted external partners and internal IT administrators to connect efficiently. This server did not have multi-factor authentication enabled.
The report admits that access scopes varied by partner and that they often held administrative privileges. A review of vendor security was scheduled for 2024, but it was too late. The searchable online catalog was restored on January 15, 2024.
The 16 lessons include cooperation with industry peers, alongside the full implementation of multi-factor authentication and network segmentation. It is a message to share information on common threats and best practices with colleagues in the same field.
In the Gallery Systems case, the vendor itself was attacked. At the British Library, the initial unauthorized access was found at an entry point for external partners. However, the British Library report also states that the exact entry point and method of intrusion cannot be definitively determined. It is not a case confirmed to have been an intrusion via a vendor. Nevertheless, it is common in that it serves as material for inspecting external connections and reliance on vendors.
To organizations with industry-common vendors
There are familiar examples where many organizations in the same industry rely on a single company’s service. These include electronic medical records for hospitals, administrative systems for local governments, and cloud services for professionals. If it were me, I would verify the following five points.
-
Decide in advance what will be handled manually if that vendor is offline for a month
-
Verify in the contract when the vendor’s backups are taken and to what point they can be restored. Also, periodically export data to your own environment
-
List the paths through which the vendor enters your company’s environment and verify the presence of multi-factor authentication
-
Decide within how many hours and who will be contacted when an accident occurs at the vendor
-
Build relationships with peers who use the same service provider so you can exchange information in the event of an incident
The final point echoes the lessons learned from the British Library. While waiting for official announcements from the service provider, organizations in the same position can confirm the scope of the damage and discuss alternative measures with each other.
Even if your own organization is not directly targeted, your work can still be brought to a halt. This week, try listing one service that many of your peers rely on the same company for. Start your review by deciding on the procedures for the morning after that company goes offline. I will continue to track and write about incidents that occur at shared industry service providers.
