Multiple London councils have been hit by a cyber attack, with the potential for residents’ data to have been compromised.
The Royal Borough of Kensington and Chelsea (RBKC) and Westminster City Council (WCC) – who share a number of IT systems – noticed the incident on Monday and have informed the Information Commissioner’s Office – a step usually taken when data is compromised.
A statement from RBKC added that the councils are working with the “help of specialist cyber incident experts and the National Cyber Security Centre (NCSC), with the focus on protecting systems and data, restoring systems, and maintaining critical services to the public”.
Graeme Stewart, head of public sector at Check Point, the company credited with inventing the firewall, said the situation had “all the signs of a serious intrusion”.
A spokesperson for the NCSC, part of the GCHQ intelligence agency and responsible for helping UK public bodies with cyber security, told Sky News: “We are aware of an incident affecting some local authority services in London and are working to understand any potential impact.”
According to the RBKC statement, they and WCC share IT services with Hammersmith and Fulham council, and there are reports services there have been impacted.
RBKC said that a “number of systems” have been impacted due to the incident, and resources have been diverted to monitor email inboxes and phone lines if people require help.
Direct cost of Jaguar Land Rover cyber attack which impacted UK economic growth revealed
M&S reveals cost of cyber attack as profit almost wiped out
Jaguar Land Rover cyber attack pushes overall UK car production down more than a quarter
The council’s statement added: “We don’t have all the answers yet, as the management of this incident is still ongoing.”
It went on: “At this stage it is too early to say who did this, and why, but we are investigating to see if any data has been compromised – which is standard practice.
“Our IT teams worked through the night yesterday and a number of successful mitigations were put in place, and we remain vigilant should there be any further incidents or issues.”
Read more:
Cost of JLR hack revealed
M&S reveals cost of cyberattack
Please use Chrome browser for a more accessible video player
Mr Stewart, from Check Point, said: “What’s happening here has all the signs of a serious intrusion: multiple boroughs knocked offline, shared infrastructure exposed, and urgent internal warnings telling staff to avoid emails from partner councils.
“That’s classic behaviour when attackers get hold of credentials or move laterally through a shared environment. Once they’re inside one part of the network, they can hop through connected systems far faster than most councils can respond.”
Keep up with all the latest news from the UK and around the world by following Sky News
👉 Listen to Sky News Daily on your podcast app 👈
He continued: “The decision to shut down services so quickly isn’t an overreaction – it tells you they suspect this could escalate into encryption or data theft.
“Councils hold incredibly sensitive material: social-care files, identity documents, housing records, everything you’d need for targeted fraud or extortion. If attackers got near that, the fallout wouldn’t stay local.
“The NCSC and Met being pulled in at speed shows this is being treated as a high-risk event, not an IT outage. And it should be.
“Local authorities remain some of the easiest public-sector targets because they’re running huge workloads on tight budgets with uneven cyber maturity.”
Be the first to get Breaking News
Install the Sky News app for free
Sky News has approached Westminster City Council and Hammersmith and Fulham Council for comment.
The Metropolitan Police has also been approached for comment.
