Lessons from a Cyberattack: The National Museum of the Royal Navy’s Journey Through Crisis and Recovery

On 9 December 2024, the National Museum of the Royal Navy faced an event that every museum hopes never to experience: a ransomware cyberattack. Overnight, the organisation’s entire digital infrastructure—from ticketing systems to collections databases—was encrypted and rendered unusable.

What followed was months of disruption, emergency response, and a hard-earned recovery. The experience highlights the scale of risk that cultural institutions face in the digital age, and offers valuable lessons for how museums can prepare for the inevitable.

The Moment of Impact

The first signs appeared early Monday morning when servers failed and systems went offline. At first, staff suspected a routine IT fault. But within hours it became clear that the National Museum had been hit with a sophisticated ransomware attack.

The fallout was immediate and severe. Ticketing and payment systems collapsed, forcing staff to handwrite tickets and rely on cash. Remote working tools, phone systems, and even printers stopped functioning. For collections staff, the blow was particularly devastating: access to the collections management system, digital asset management system, online collections, and digital archives was suddenly lost.

As Amy Adams, Collections Information and Access Manager, explains, “We didn’t know right away whether our collections management system was going to be recoverable… That took an emotional toll on our curators and collections teams. It felt like 40 years of collective knowledge about the collection had disappeared overnight.”

Going Dark to Protect What Remained

Faced with the scale of the attack, the museum made a bold decision: to take everything offline. Email, intranet, Wi-Fi—every system that remained was shut down in an effort to stop the spread. Staff across six sites were required to return nearly 400 devices, including laptops, phones, and hard drives, which were then wiped and rebuilt from scratch.

This “blackout period” bought the museum time to understand the extent of the damage and plan a careful path forward. It also underscored the human impact of such incidents. Staff lost their ability to perform even basic daily tasks, and many were forced back into manual workflows—clearing offices, sorting old paper records, reviewing VHS tapes, and working with offline forensic machines.

HMS Warrior at the Portsmouth Historic Dockyard, England

Financial and Organisational Consequences

The financial hit was immediate. Without digital ticketing or payment systems, the museum lost critical visitor income. Recovery costs quickly mounted, from emergency IT support to long-term investments in infrastructure.

Equally significant was the loss of staff time. Hundreds of employees were left without access to the systems they relied on, while IT teams worked around the clock to stabilise services during the IT dark period. For collections staff, the fear of permanent data loss was compounded by the closure of collections access services and the inability to process new acquisitions.

Recovery: A Marathon, Not a Sprint

In the months that followed, the National Museum began the painstaking process of restoring systems. Some, such as ticketing, were prioritised and back online by Christmas. Others, particularly collections databases, took much longer. The collections management system did not return until March 2025, and the digital asset management system is still being rebuilt.

As George Wilson, Head of IT, notes, recovery required more than restoring data. It demanded a complete reassessment of digital infrastructure. “Different teams across the organisation recover at different points. For front-of-house, everything looked fixed by Christmas. But behind the scenes, many systems were still broken—and some still are nine months on.”

Building Back Stronger

One of the most important lessons was the need for robust, modern cybersecurity. Prior to the attack, the National Museum had already begun strengthening its systems in response to the British Library incident in 2023, but sadly wasn’t in time to stop the December attack. The attack has now accelerated that process dramatically.

The museum is implementing a hybrid IT model combining on-premise servers, cloud infrastructure, and SaaS platforms. Key measures include:

• Regular penetration testing and vulnerability assessments
• Patch management solutions with regular updates schedules
• Managed detection and response services with endpoint and network monitoring
• Cyber Essentials compliance as a benchmark standard
• Robust backup and disaster recovery systems, including immutable cloud storage and an off-site failover environment

Perhaps the most sobering takeaway is the acceptance that cyberattacks are no longer a question of if, but when. As George reflects, “Even though we’ve been through it, there’s a good chance we’ll face it again. What matters is having bulletproof backup and recovery solutions in place.”

Lessons for the Sector

The National Museum’s experience echoes what other institutions have faced: cyberattacks can have the same impact as a fire or flood. The damage may be invisible, but the risk to collections, infrastructure, and institutional memory is no less severe.

For museums, preparation is key. That means investing in prevention and detection, but also building resilience into collections management and digital access systems. Just as importantly, it means recognising the human toll—supporting staff whose work and expertise may suddenly feel at risk of vanishing.

A Sobering Reminder

For the National Museum, recovery has been long and difficult, but also transformative. The organisation is emerging with stronger systems, improved security, and hard-earned lessons to share with the sector.

The experience serves as a reminder to all museums: digital assets are as fragile and precious as physical collections. Protecting them requires investment, planning, and an acceptance that resilience is a long-term commitment.

–

Amy Adams and George Wilson from the National Museum of the Royal Navy spoke at the Digital Collections Summit 2025