Expert Voices — Heritage Cybersecurity
Kai London is a cybersecurity author, not a business or trading name.
Cultural heritage institutions occupy an unusual position in the cybersecurity landscape. They hold assets of extraordinary value — irreplaceable artefact records, provenance documentation, sensitive site location data, and digitised collections representing centuries of human history — yet they typically operate on budgets and with IT staffing levels that would be considered wholly inadequate in even a small commercial enterprise. This asymmetry between asset value and defensive capability defines the threat environment for museums, archives, libraries, and archaeological research institutions.
The digitisation of cultural heritage has accelerated dramatically over the past two decades. Collection management systems now hold tens of millions of records. Archaeological field projects generate gigabytes of LiDAR data, photogrammetric models, and georeferenced databases per season. Museum visitor engagement systems collect personal data subject to data protection regulation. Each of these digital expansions increases the attack surface while institutional cyber defences have generally failed to keep pace with the new landscape.
"Heritage institutions do not become cybersecurity targets because adversaries value culture. They become targets because they hold valuable data and, all too often, inadequate defences."
The specific nature of cultural heritage digital vulnerability differs from standard commercial risk in important ways. For commercial organisations, the primary concern is typically financial data and customer records. For heritage institutions, the risks extend to the potential for site location data to enable looting of unprotected archaeological sites, the permanent loss of digitised records that exist nowhere else, reputational damage that undermines public trust in institutions whose mandate rests on stewardship, and the compromise of researcher and donor personal data with all associated regulatory consequences.
The 2023 British Library ransomware attack stands as the most consequential cyber incident in UK cultural heritage history. In October of that year, the Rhysida ransomware group — a criminal organisation that had already targeted healthcare and education sectors — encrypted significant portions of the British Library's systems and exfiltrated an estimated 600 gigabytes of data. The attackers demanded a Bitcoin ransom which the Library declined to pay.
The consequences were severe and prolonged. The Library's online catalogue, website, and reader registration systems were offline for months. Staff payroll data and personal information of Library users were published on the dark web after the ransom was refused. The remediation cost was publicly estimated at between £6 million and £7 million — an extraordinary sum for a public institution operating under sustained budget pressure. The British Library's own published retrospective acknowledged that legacy IT infrastructure and insufficient network segmentation had amplified the attack's impact.
Case Reference: Colonial Pipeline Analogy
The 2021 Colonial Pipeline attack in the United States, while targeting energy infrastructure rather than cultural heritage, illuminates dynamics directly relevant to heritage institutions. Colonial's operational technology and business networks were insufficiently isolated; a single compromised credential in a VPN account gave the DarkSide group access that ultimately shut down fuel distribution across the eastern United States seaboard.
The structural lesson applies directly to museums and archives: flat networks, shared credentials, and inadequate segmentation between operational and administrative systems transform local vulnerabilities into catastrophic institutional failures. Heritage institutions that continue running collection management systems on the same network segments as visitor Wi-Fi are repeating Colonial's structural errors in a different domain.
Ransomware operators have increasingly recognised the cultural sector as a productive target. Public institutions face political pressure to restore services quickly; collections data is perceived as irreplaceable, increasing willingness to pay; and heritage organisations often lack the incident response capabilities to contain attacks rapidly. Several smaller museum and archive incidents in the United States and Europe since 2020 have followed a similar pattern: phishing-delivered initial access, lateral movement across under-segmented networks, and either encryption of files or exfiltration-and-extortion combinations.
Archaeological databases present security challenges that differ from general institutional IT risk in ways that require specialist thinking. The most sensitive category of archaeological data is site location information: coordinates and descriptive data that, if accessed by bad actors, could enable targeted looting of unexcavated or partially excavated sites. This is not a theoretical risk — metal detector and equipment sales alongside a known correlation between database breaches and subsequent site disturbance in several international cases have underscored the real-world consequences of inadequate access controls.
Securing archaeological databases requires a tiered access model in which site location data at full precision is accessible only to field staff with a demonstrated need, while broader contextual records may be made available to researchers and the public at appropriately generalised geographic resolutions. This principle of graduated disclosure is well-established in wildlife conservation (where precise nest coordinates of endangered species are similarly restricted) and should be standard practice in archaeological data management.
Beyond access control, archaeological databases benefit from specific technical protections. Encryption at rest ensures that physical theft of storage media does not compromise sensitive data. Comprehensive audit logging records every access, export, and modification of sensitive location records, creating an accountability trail that can identify both external intrusions and insider misuse. Regular backups stored offline and geographically separate from primary systems are essential given the irreplaceable nature of excavation data.
"A site database is not just an IT asset. It is a map to sites that may not yet have been fully excavated — and in the wrong hands, it is a looting guide."
The majority of successful cyber attacks on heritage institutions — as in most sectors — begin not with sophisticated technical exploits but with human failure: a staff member clicking a phishing link, reusing a compromised password, or inadvertently granting access to a social engineering caller. This is not a criticism of individual staff but a reflection of the environment in which cultural heritage workers operate. Archaeological researchers and museum professionals are trained in entirely different disciplines; cybersecurity awareness is rarely integrated into their professional formation.
Security awareness training in heritage institutions must be contextualised to be effective. Generic corporate cybersecurity training — typically designed around sales teams and financial administrators — rarely resonates with archaeologists, curators, or archivists. Effective awareness programmes in the heritage sector frame threats in terms of the specific harms that resonate: collections data being stolen and sold, donor databases being leaked, or site locations being used by looters. When the stakes are made concrete and relevant to professional identity, staff engagement with security training improves measurably.
Governance structures also differ in heritage institutions. Many smaller museums and archaeological organisations rely on volunteer trustees or council members with no technology background to provide oversight of digital risk. Building effective governance requires translating cybersecurity risk into language that resonates with trustees whose expertise lies in art history, archaeology, or fundraising — framing data breaches in terms of reputational risk, regulatory consequence, and operational disruption rather than technical vulnerability categories.
Not every heritage institution can afford a dedicated security operations centre or a Chief Information Security Officer. The following recommendations are proportionate measures that small and medium-sized museums, archives, and archaeological organisations can implement without large technology budgets, drawing on freely available guidance from the UK National Cyber Security Centre, the US Cybersecurity and Infrastructure Security Agency, and peer institutions that have published their post-incident learnings.
The digital transformation of cultural heritage has delivered extraordinary benefits: global access to collections, richer research through cross-institutional data sharing, and new tools for understanding and communicating the human past. But digitisation without security is not preservation — it is the creation of new vulnerabilities that put irreplaceable cultural knowledge at risk.
The British Library attack in 2023 was not an isolated event but a signal. It demonstrated that cultural institutions, long perceived as peripheral to the interests of sophisticated threat actors, have become mainstream targets. Smaller institutions that draw the wrong lesson — that they are too obscure to attract attention — are making precisely the miscalculation that ransomware operators depend upon.
Protecting cultural heritage in the digital age is not solely an IT problem. It requires archaeologists, curators, archivists, and trustees to understand that the decisions they make about data access, network architecture, and backup practices are as much acts of stewardship as the care they take with physical artefacts. Digital artefacts can be destroyed as completely as any physical object — and far more quickly.
The field has the knowledge, the frameworks, and the community to meet this challenge. What it requires now is the institutional will to treat cybersecurity not as a peripheral IT function but as a core element of heritage stewardship for the twenty-first century.
"We do not accept that a museum should leave its doors unlocked at night. We should not accept that its digital equivalent remains unguarded either."