The UK’s leading book printer, CPI, and The Agency have both been hit by ransomware attacks, The Bookseller understands.
Clients of CPI, including Welsh independent Firefly Press, have been majorly affected with some profits “wiped out”. The cyber attack on The Agency – a London-based literary agency – has been attributed to the Rhysida ransomware group, which previously targeted the British Library, and has allegedly threatened to publish stolen data if not paid a ransom. It is unknown whether the same ransomware group is responsible for the CPI attack.
A spokesperson for CPI told The Bookseller: “In the early hours of Friday, 7th February 2025, our IT systems were disabled, affecting the UK part of our business. After completing initial forensic analysis we were able to determine that we had encountered a cyber attack, despite having significant protection already in place across our entire network.
“As soon as the attack was identified, we engaged specialist external technical support, who along with our own teams have been working to recover our systems as quickly as possible. Our colleagues across the whole business have been working extraordinarily hard to develop workarounds as well as to reimplement our IT systems and have made substantial progress. We continue dialogue with our customers and other stakeholders to ensure that they are fully aware of the status. We expect to resume full services gradually over the coming days.”
CPI Books is the UK’s leading book printing group, and prints across nine UK factories, producing 160 million books every year, as well as journals and loose-leaf products.
Penny Thomas, publisher at Firefly Press, told The Bookseller of the impact: “CPI has been a fantastic printer and has been fantastic with information and explaining. I know they’re trying their best with workarounds but it has hit us pretty hard. We have one book at the printers which is due out in March which I’ve had to quickly digitally print elsewhere... In fact I’ve had to do that with two to three print runs which will effectively wipe out some of our profits on some of our print runs so it’s quite serious... It will significantly hit our profits on one particular order... and would quite probably wipe out profits on one significant order for us.
“We’re completely out of stock with one book, which I know will take them longer. I know they’re trying their absolute best but they can’t guarantee when things will be back up and running, so it’s been expensive for us and it’s difficult and we’re running out of some books where we’re normally good at keeping things in stock.
“I’ve been to other printers and either they can’t fit us in or their prices aren’t as competitive. I know they print about two million books from one factory so I’m guessing a lot of other people have been affected. I do feel for CPI – they don’t deserve this and it must be quite devastating for them.”
Jessica Hare, who heads up the books department at The Agency, circulated an email seen by The Bookseller which reads: “Unfortunately, The Agency has been subject to a ransomware attack by a criminal cyber group. This caused a significant IT outage as the malware deployed encrypted company data files and prevented access. The Rhysida ransomware group, who have targeted many high-profile organisations in recent times (including, for example, the British Library), have claimed they are behind the attack and that they will publish stolen data if not paid a ransom.
“We are contacting you because your personal data may have been copied and, if the criminals carry through their threat, may be leaked. Whilst our IT specialists and an additional cyber security company are working hard to identify which items of data have been copied, the attack methodology of Rhysida involves defence evasion and anti-forensics, i.e. a deliberate ‘clean-up’, making it hard to trace their activity. At this stage there is no evidence that any data has been made public but it is advisable to be vigilant about your accounts and emails.”
She added: “Sadly these types of attacks are extremely common. We have been informed that several companies have been attacked just this week. We have taken targeted protective measures to ensure the security of our systems and continue to closely monitor them as a priority. We are continuing to investigate the attack with the assistance of IT and cyber security specialists and the Metropolitan Police Service cybercrime unit.”
Clients were urged in the email to be wary of new details apparently sent out by The Agency and to contact the company immediately if they were in doubt. The company was not able to add any further comment to The Bookseller as it said the team was “busy dealing with the fall out” from the incident.
The British Library reportedly spent £6m rebuilding its digital services after the Rhysida attack in autumn 2023.
The UK's leading book printer, CPI, and The Agency have both experienced ransomware attacks, according to reports from The Bookseller. CPI clients, including Firefly Press, have been significantly impacted, with some profits being wiped out. The cyber attack on The Agency, a London-based literary agency, has been linked to the Rhysida ransomware group, which previously targeted the British Library and has threatened to publish stolen data if a ransom is not paid. It is unclear if the same ransomware group is responsible for the CPI attack.
A spokesperson for CPI stated that their IT systems were disabled on February 7th, 2025, due to a cyber attack. Despite having strong protection measures in place, the attack still occurred. The company is working with external technical support to recover their systems and expects to resume full services gradually over the coming days. CPI Books is known for printing 160 million books annually across nine UK factories.
Firefly Press publisher Penny Thomas shared that the ransomware attack has had a significant impact on their operations, forcing them to seek alternative printing options for upcoming book releases. The Agency's books department head, Jessica Hare, informed clients of the ransomware attack and advised them to be vigilant about their personal data potentially being leaked.
The British Library reportedly spent £6 million to rebuild its digital services after a previous ransomware attack by the Rhysida group in autumn 2023. These types of cyber attacks are unfortunately common, and companies are urged to take protective measures to safeguard their systems and data.
