Museums “left vulnerable to cyber attacks” warns Public Accounts Committee

A number of high-profile incidents in 2023, including both the cyber attack at The British Library and the thefts reported at The British Museum, served to highlight the vulnerability of these institutions.

Although the Government has facilitated the sharing of lessons learned, it was unable to provide specific examples of concrete actions taken as a result to better protect systems and collections in the wake of these incidents.

The Committee doesn’t believe that the Department for Culture, Media and Sport (DCMS) is taking advantage of its central role to bring museums and galleries together to better address these issues. It finds that measures including the implementation of digital record-keeping should be considered and has asked the DCMS to set out the concrete actions taken by the Government, museums and galleries to address cyber and physical security threats.

Popular attractions

The UK’s national museums and galleries are among the country’s most visited attractions, with the Natural History Museum (pictured) alone drawing in 7.1 million visitors in 2025. In 2024-2025, the self-generated income of museums and galleries totalled £563 million, which represents a 53% real-terms increase when compared to 2021-2022.

However, those income streams are vulnerable to wider economic conditions and visitor numbers, which have not returned to pre-pandemic levels, with costs also rising due to higher staffing costs and energy bills.

Amid these challenges, the DCMS provided 15 Government-sponsored museums and galleries with £484 million in grant-in-aid funding in 2024-2025. This represents a real terms reduction of 16% as emergency COVID-19 pandemic funding has now ended.

The Public Accounts Committee recommends that the DCMS should set out clear metrics by which it will assess museums and galleries, while also outlining what consequences there will be for those that don’t meet the criteria it sets out to measure them against.

The Committee has also asked the DCMS to set out the circumstances in which it would allow the financial failure of a museum or gallery amid concerns that the current funding regime doesn’t provide museums and galleries with sufficient incentives to support themselves financially.

Fabric of the nation 

Sir Geoffrey Clifton-Brown, chair of the Public Accounts Committee, said: “Our museums and galleries are a treasured part of the fabric of our nation. The role they play in educating our people, preserving our shared history and showcasing our country to the world is,, quite simply priceless.”

Clifton-Brown continued: “However, they are being let down by a lack of leadership from the Department of Culture, Media and Sport, which appears to have taken an almost hands-off approach to the challenges they face.”

Further, Clifton-Brown observed: “Cyber attacks, the theft of items from collections and a fall in the number of visitors are just some of the issues museums and galleries are fighting to overcome. They’ve made great strides to become more financially resilient, but the lack of centralised support is leaving them vulnerable. Further, Government has not done nearly enough to provide incentives for museums and galleries to be in a position to support themselves from a financial standpoint.”

Simon Edwards, CEO at SE Labs, informed Security Matters: “The Public Accounts Committee’s report underlines the fact that growing volumes of increasingly sophisticated cyber attacks pose a major threat to Britain’s museums and galleries. The reality is that these organisations are often seen as a soft target for hackers due to the large amounts of customer data they process along with perceived security weaknesses when compared to other public bodies. This is why it’s absolutely vital that a dedicated cyber strategy is put in place to protect these treasured institutions and ensure rigorous testing to identify any security holes and keep would-be hackers at bay.”