Hackney Council: Cyber-attack cost ‘hundreds of thousands’

In January 2021 a criminal group posted personal details of council staff and residents on the dark web following a ransomware attack three months earlier.

In July of this year, the Information Commissioner’s Office (ICO) rebuked the local authority for a “lack of proper security and processes to protect personal data”.

Stephen Bonner, deputy commissioner at the ICO, called the breach a “clear and avoidable error” by the council, after the regulator found “simple mistakes like having dormant accounts where the username and password are the same”.

“Whilst nefarious actors may always exist, the council failed to effectively implement sufficient measures that could have better protected their systems and data from cyber-attacks,” Mr Bonner added.

“Time and time again, we see breaches that would not have happened if such mistakes were avoided,” he said.

Responding at the time, Hackney Council disagreed with the ICO’s findings, saying it had not been in breach of its security obligations.

In 2023, the council announced it would purchase a new “off-the-shelf” housing system to deal with ongoing tech problems following the hack.

The fallout from the cyber-attack has exacerbated the “challenging financial environment” for the borough, council reports state, especially due to a real-terms fall in government funding of almost 40% since 2010.