The 'significant' threat of a major cyber attack on Greater Manchester

A successful cyber attack against Greater Manchester could put police GPS systems out of use and stop doctors accessing vital health data in an emergency, an expert has said in a frightening warning.

While it may sound like the plot to a science fiction film, the risk of such an attack against the region is 'significant and persistent', said Ali Kashif Bashir, Professor of computer networks and cybersecurity at Manchester Metropolitan University.

The warning comes as a new report from the Greater Manchester Combined Authority (GMCA) said the region is in a 'hostile threat landscape' and is facing major risks from cybercriminals and other countries.

Leaders across Greater Manchester are meeting on Monday (September 21) in a gathering which includes a deep-dive into cyber security. Part of the discussion will be held behind closed doors with no press or public access permitted.

According to GMCA papers, attackers are actively trying to disrupt Greater Manchester's emergency services, spread disinformation, and interfere with democracy.

So what could a successful cyber attack look like?

"It means [against] the police, healthcare, or any other critical systems," Professor Bashir said.

"One example could be doctors not able to verify the identity of a patient or the disease because everything is stored online, and police trying to trace let's say a criminal car and GPS outputs cannot be trusted.

Download our Nub News App!

"The maximum level of impact could be systems completely not being available at all. For example, we had the NHS WannaCry attack on the healthcare system, with thousands and thousands of systems not available for a few days or one to two weeks, which disturbed a lot of patients who could not get emergency treatment."

Greater Manchester has recently been victim to different cyber attacks which have affected thousands of people.

A data security incident at Manchester Airport Group in August meant criminal hackers got hold of customer data.

A spokesperson said at the time that the airport group 'immediately contained the risk' and had been 'working with specialist advisors and taking appropriate steps to protect customers and systems.'

Three Greater Manchester councils faced problems in 2024 when a Russian-linked hacking group called NoName057(16) claimed responsibility for attacks on software company Locata, which downed the housing websites for Manchester, Salford and Bolton councils.

The GMCA paper on cyber security directly names NoName057(16), saying it 'has made frequent attempts against UK local government'. China, North Korea, and Iran are also named as being behind 'campaigns' against the UK, according to the National Cyber Security Centre.

"The particular concern for Greater Manchester is its highly interconnected digital ecosystem across healthcare, local government, transport and businesses.," Professor Bashir added.

"A successful attack could therefore go beyond data theft and affect the availability and continuity of essential services."

Greater Manchester could be seen as an 'attractive' choice for hackers and criminals because of its national importance in the UK, including the opening of Number 10 North in Manchester city centre by Prime Minister Andy Burnham.

But Professor Bashir said: "There is currently no public evidence that No.10 North has directly increased cyber activity against Greater Manchester.

"A national government presence could increase the region's strategic value as a target for cyber espionage, intelligence collection, disruption or influence operations.

"Importantly, sophisticated threat actors may adopt a 'low-and-slow' approach – gaining persistent access and remaining dormant until an operationally significant opportunity arises.

"The threat should be considered significant and persistent.

"Greater Manchester has a highly interconnected digital ecosystem spanning critical infrastructure, healthcare, local government, transport, industry and major public-facing organisations, and now a PM elected from this city, which creates an attractive attack surface for both financially motivated criminals and state-linked actors."

The GMCA said it couldn't on the specific security arrangements it has in place to stop a major cyber attack from succeeding.

Around £1.2m has been spent on what is known as 'strengthening cyber resilience', covering monitoring and detection, incident response, vulnerability management and penetration testing.

The GMCA has also made fixed-term cyber roles into permanent jobs in a sign of the growing need for experts keeping the region safe.

A GMCA spokesperson said: "Any organisation that provides essential public services can be a target for cyber criminals.

"The update going to GMCA's audit committee concerns our internal cyber security programme and the steps we are taking to strengthen resilience, reduce risk and support recovery in the event of an incident.

"We're unable to on specific security arrangements, but we continue to work with partners and follow National Cyber Security Centre guidance, with a focus on both prevention and resilience."

Locata, the software firm targeted in 2024, said: "We have completed a lot of work to ensure our systems are secure, and we continue to do so to defend against cyber-attacks.

"As you know, these attacks are a constant threat to all businesses and individuals, and they are becoming increasingly sophisticated, particularly now with advances in AI capabilities.

"However, our monthly briefings and quarterly security rundown (which includes our board governance report) have ensured that, to date, there have been no further successful attacks since 2024."

Manchester City Council said it is continuing to invest in cyber security in response to an 'evolving threat landscape'.

A spokesperson said: "As a matter of policy, the council does not on the detail of cyber security investigations or operational security matters, and we would not speculate on attribution or identify those responsible unless this has been formally established and publicly confirmed by the appropriate authorities and law enforcement agencies."

A Salford City Council spokesperson said the authority takes cyber security 'extremely seriously'.

They added: "We continue to strengthen our cyber defences, including investment in specialist security monitoring, improved protection for our devices and networks, and enhanced capability to identify and respond to suspicious activity.

"This investment in our digital infrastructure also includes working with partners and suppliers to strengthen resilience and reduce risk.

"Our focus remains on protecting information, preventing disruption and ensuring essential council services remain resilient."

Bolton Council did not respond to a request for .

Download our Nub News App: - It’s FREE and available now - Breaking news notifications - Your Town in Your Pocket

Local news is in crisis.

Local news is in crisis.

Keep your town in your pocket.

New continental beer bar could be opening soon in Stockport's historic Underbanks

Police thank local residents after missing 13-year-old Lillia found safe and well