MPs urge stronger protection for British museums after security failures

Digital systems and physical collections remain at risk

Britain's museums and galleries are exposed to cyberattacks and theft because they haven’t learned from their mistakes, warns a committee of MPs

Britain's museums and galleries remain dangerously exposed to cyberattacks and theft because the government has failed to turn recent security failures into lasting reforms, MPs have warned.

A new report published by Parliament's Public Accounts Committee (PAC) said high-profile incidents, including the ransomware attack on the British Library and the theft of thousands of objects from the British Museum, exposed significant weaknesses that have yet to be properly addressed across the cultural sector.

The cross-party committee said national museums and galleries had not sufficiently learned from the incidents and warned that both digital systems and physical collections remain at risk.

The British Library was forced to restore services over several months after a ransomware attack in 2023 disrupted operations and resulted in the theft of staff and user data.

Around the same time, the British Museum disclosed that roughly 2,000 artefacts had been stolen, damaged or had gone missing from its collections over a number of years, prompting the resignation of its then director, Hartwig Fischer.

MPs said the two cases demonstrated the need for stronger safeguards, both to protect valuable collections and to strengthen cyber defences against increasingly sophisticated attacks.

Although the Department for Culture, Media and Sport (DCMS) had organised discussions following the breaches, the committee said it was unable to identify clear evidence that those conversations had resulted in meaningful improvements across the museum sector.

The committee urged ministers to explain what practical steps museums and galleries have taken to reduce cyber and physical security risks.

It recommended wider adoption of digital inventory systems to improve oversight of collections and help detect missing items more quickly.

Multiple challenges

Sir Geoffrey Clifton-Brown, chair of the Public Accounts Committee, said museums and galleries faced multiple challenges simultaneously, from cyberattacks and theft to financial pressures and slower-than-expected visitor recovery following the pandemic.

"Our museums and galleries play a priceless role in educating people, preserving our shared history and showcasing our country to the world," he said.

"They've made great strides to become more financially resilient; however, the lack of centralised support is leaving them vulnerable."

The report found that museums and galleries generated £563 million in self-generated income during the 2024-25 financial year, representing a 53% increase in real terms compared with 2021-22.

However, visitor numbers have still not returned to pre-pandemic levels, while institutions continue to face higher staffing and energy costs alongside a 16% real-terms reduction in government funding following the end of emergency Covid support.

MPs also criticised the DCMS for lacking clear measures to assess whether publicly funded museums were delivering value for taxpayers and questioned whether the current funding model encouraged institutions to become financially sustainable.

The committee noted that ministers are considering proposals to introduce entry charges for international visitors to national museums following recommendations made in a recent government-commissioned review.

DCMS responds

Responding to the findings, the DCMS said it had previously focused on supporting organisations after cyber incidents occurred but was now working more closely with museums and galleries to improve resilience before attacks happen.

The department also cited its Cyber Action Plan, backed by £210 million in government funding, which aims to strengthen baseline cybersecurity standards across public bodies by the end of the decade.

The programme includes measures to modernise outdated technology, improve risk monitoring, strengthen incident response capabilities and provide greater central support for organisations facing evolving cyber threats.