Borrowers at libraries in Stockholm, Norrköping and Södertälje have been notified that they must set new PIN codes for their library cards. In addition to a four-digit PIN, an email address is now also required.
This follows hackers cracking borrowers' PIN codes and creating a large number of new accounts to borrow e-books.
"The only purpose of the attack that we can see is that the login details were used to borrow e-books in the e-book service Biblio," says Mimmi Fristorp, communications and program manager at Stockholm City Library.
8,000 new accounts
Biblio's owner, Danish company Wedobooks, discovered on Tuesday that the number of new e-book accounts in Sweden was increasing exponentially and therefore closed the app.
"Suddenly, 8,000 new accounts were created," says Jeppe Nyrup.
However, the Biblio app's login method is determined by the libraries themselves, emphasizes Jeppe Nyrup. Hackers were able to crack the codes because many of them were so simple. A striking number of borrowers had chosen 1234 as the four-digit code, or the last four digits of the personal identification number, which in Sweden, unlike in Denmark and Norway, are public, emphasizes Jeppe Nyrup.
"Hasn't Sweden heard of GDPR?"
“Weakness in the system”
What is the purpose of hacking Swedish public library lending apps?
"This is just speculation, but often when you discover attacks like this it's someone who has just found a weakness in the system and wants to make the world aware that it is not secure," says Jeppe Nyrup.
Wedobooks has reported the attack to the cybersecurity unit at the Swedish Civil Defence Agency. Stockholm City Library has filed a police report.
According to Mimmi Fristorp, libraries will not have to pay anything for the many e-book loans made by hackers.
