Hackney, Westminster, the Royal Borough of Kensington & Chelsea (RBKC) and Hammersmith & Fulham councils have all reported IT issues in the last 48 hours.
The councils are suffering suspected cyber attacks, with Hackney raising its threat level to “critical” and telling staff to prioritise protecting residents’ data.
The BBC’s Local Democracy Reporting Service says the council has sent staff an urgent memo warning them against phishing attacks.
The note says, “We have received intelligence that multiple London councils have been targeted by cyber-attacks within the last 24-48 hours, with potential disruption to systems and services.
"Your immediate co-operation is essential to protect the council and the data of our residents.”
Meanwhile, Westminster City Council says people are struggling to get in touch. The LDRS has seen an internal memo saying the council has shut down all of its networks as a precautionary measure, following a “cybersecurity incident.”
The council wrote on X that it was experiencing “a serious IT issue” and is “working internally with our partners” to resolve it.
According to sources speaking to the LDRS, some RBKC council systems have been down for two or three days at this point.
Hammersmith & Fulham Council posted a similar memo, saying it was responding to a cyber incident.
Both the National Cybersecurity Centre and the Metropolitan Police have been informed, showing the councils are treating this as an attack rather than a simple IT outage.
London Mayor Sadiq Khan said, “We are trying to encourage councils to have better resilience but the reality is, I'm afraid, those who breach protections are going to try more and more ways to get into those systems. We're going to make sure we're resilient, that means making sure we have the right safeguards in place.”
Graeme Stewart, head of public sector at Check Point, told us that taking out a London council is much more than just a nuisance - “It’s a direct hit on the people who rely on social care, housing support and safeguarding teams to keep them safe.
“When these systems stall, the impact lands on residents who have no buffer.”
Ian Nicholson, Head of Incident Response at Pentest People, called out the fragility of connected systems:
“The report...goes to prove how fragile shared public-sector infrastructure can be. When environments are completely interconnected, compromise in one area quickly propagates across the whole environment. Think supply chain attacks. Again and again, we see attackers exploiting legacy systems, we see slow patching and underfunded, understaffed IT teams.”
Hackney Council suffered a serious cyber incident in 2020, which affected 280,000 residents and staff.
The ICO reprimanded the council over the incident last year, finding examples of a lack of proper security and processes to protect personal data.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
