Report warns councils after 2023 Western Isles cyber-attack

The Accounts Commission has concluded that the 2023 Western Isles cyber-attack shows councils must strengthen cyber-resilience, after severe disruption and long-standing weaknesses were exposed.

A new report on the major 2023 cyber-attack on Comhairle nan Eilean Siar (Western Isles Council) has warned that the incident should serve as a wake-up call for local authorities across Scotland.

The Accounts Commission (AC) found the attack caused immediate, severe and prolonged disruption, with the council’s finance team hit hardest after suffering a near-total loss of data on its servers.

While the report acknowledges that the council responded quickly, it highlights long-standing weaknesses in IT infrastructure, governance, preparedness and staff capacity — issues first identified in 2021/22. The AC stated that earlier action could have significantly reduced the impact of the attack.

Jo Armstrong, Chair of the Accounts Commission, said: “This cyber-attack shows how exposed local government is, and the urgent need to test resilience and recovery arrangements. We also want the council to improve how it communicates with and supports staff during major incidents that increase workload and stress.”

Two years on, some council services are still recovering and continue to face backlogs. Armstrong praised staff for going “above and beyond” to support service users, suppliers and the wider community during the aftermath.

The Commission’s report, prepared by the Controller of Audit, stresses the need for all Scottish councils to strengthen their cyber-resilience: “We urge all councils to prioritise preparation and testing of plans.

"Nobody is immune from attack, but everyone can be prepared so disruption is minimised — especially for councils delivering vital services to the most vulnerable."