Multiple London councils 'hit by cyber-attacks'

Several London councils are believed to have been targeted in cyber-attacks within the past few days.

The Royal Borough of Kensington & Chelsea (RBKC) said that it and Westminster City Council were "responding to a cyber incident affecting some shared IT systems" and that some some systems, including phone lines, were disrupted.

RBKC said two councils were working with cyber specialists and the National Cyber Security Centre to protect data and restore services and apologised for disruption. The Met Police is investigating.

Hammersmith & Fulham Council said in a memo it had experienced a "serious cyber security incident" and that it was "working to fix the problem as quickly as possible".

RBKC said the issue was identified quickly on Monday and that emergency plans had been activated so that critical services could still be delivered.

The statement added it was investigating the ongoing incident and would provide information when it was available.

"We would like to apologise for any disruption and thank residents for their patience as we work to bring systems back online safely," it said.

On its website, the council said it was "too early to say who did this, and why, but we are investigating to see if any data has been compromised".

The Information Commissioner's Office has been notified, RBKC said.

According to the LDRS sources, some systems at RBKC have been down for two to three days.

The Hammersmith and Fulham Council memo suggested its issues were connected with the incident affecting RBKC and Westminster councils.

It said a few connectivity issues remained, but these could not be resolved until RBKC could guarantee its networks were safe, which could take some days.

It also urged staff not to click on any links sent from Kensington and Chelsea Council and Westminster City Council colleagues in Outlook or Teams accounts "until further notice".

A statement on Hammersmith and Fulham's website read: "We are continuing to take precautionary measures to review, isolate and protect our networks.

"We're working to fix the problem as quickly as possible and we apologise for the inconvenience."

The Met Police said it had received a referral from Action Fraud.

"Enquiries remain in the early stages within the Met's Cyber Crime Unit. No arrests have been made," the statement added.

Elsewhere, Hackney Council said its staff had been sent an urgent memo warning them against phishing attacks.

An official note seen by the LDRS stated: "We have received intelligence that multiple London councils have been targeted by cyber-attacks within the last 24-48 hours, with potential disruption to systems and services.

"Your immediate co-operation is essential to protect the council and the data of our residents."

The note said Hackney Council had raised its cyber security threat to "critical" and urged staff to help protect residents' data.

The east London council itself has not been targeted, the authority says.

Mayor of London Sir Sadiq Khan said he was unaware of the attacks when asked by the LDRS earlier on Tuesday.

However, he said City Hall was helping councils build better cyber-resilience to learn lessons from previous the attacks like the ones on Transport for London, Marks & Spencer and Heathrow Airport.

He said: "We are trying to encourage councils to have better resilience but the reality is, I'm afraid, those who breach protections are going to try more and more ways to get into those systems."

Hackney Council was hit by a serious cyber attack in 2020 that led to criminals gaining access to and encrypting 440,000 files, affecting at least 280,000 residents and other individuals including staff.

The Information Commissioner's Office reprimanded the council last year over the incident, saying it found "examples of a lack of proper security and processes to protect personal data".

Correction November 26: A previous version of this story said Hackney Council had been affected, the story has now been updated to say it has not and that staff had been sent an urgent memo warning of an attack.

Listen to the best of BBC Radio London on Sounds and follow BBC London on Facebook, X and Instagram. Send your story ideas to [email protected]