TL;DR
- Multiple London councils, including the Royal Borough of Kensington and Chelsea and Westminster City Council, have experienced a cyber attack, with potential data compromise under investigation.
- The councils are collaborating with the National Cyber Security Centre and cyber incident specialists to restore services while monitoring the integrity of their systems and data.
- Experts indicate the attack exhibits signs of serious intrusion, with advice for staff to avoid emails from partner councils, highlighting the sensitivity of the data involved.
London councils hit by ‘cyber attack’ with data potentially compromised | UK News
Multiple London councils have been hit by a cyber attack, with the potential for residents’ data to have been compromised.
The Royal Borough of Kensington and Chelsea (RBKC) and Westminster City Council (WCC) – who share a number of IT systems – noticed the incident on Monday and have informed the Information Commissioner’s Office – a step usually taken when data is compromised.
A statement from RBKC added that the councils are working with the “help of specialist cyber incident experts and the National Cyber Security Centre (NCSC), with the focus on protecting systems and data, restoring systems, and maintaining critical services to the public”.
Graeme Stewart, head of public sector at Check Point, the company credited with inventing the firewall, said the situation had “all the signs of a serious intrusion”.
A spokesperson for the NCSC, part of the GCHQ intelligence agency and responsible for helping UK public bodies with cyber security, told Sky News: “We are aware of an incident affecting some local authority services in London and are working to understand any potential impact.”
According to the RBKC statement, they and WCC share IT services with Hammersmith and Fulham council, and there are reports services there have been impacted.
RBKC said that a “number of systems” have been impacted due to the incident, and resources have been diverted to monitor email inboxes and phone lines if people require help.
The council’s statement added: “We don’t have all the answers yet, as the management of this incident is still ongoing.”
It went on: “At this stage it is too early to say who did this, and why, but we are investigating to see if any data has been compromised – which is standard practice.
“Our IT teams worked through the night yesterday and a number of successful mitigations were put in place, and we remain vigilant should there be any further incidents or issues.”
Mr Stewart, from Check Point, said: “What’s happening here has all the signs of a serious intrusion: multiple boroughs knocked offline, shared infrastructure exposed, and urgent internal warnings telling staff to avoid emails from partner councils.
“That’s classic behaviour when attackers get hold of credentials or move laterally through a shared environment. Once they’re inside one part of the network, they can hop through connected systems far faster than most councils can respond.”
👉 Listen to Sky News Daily on your podcast app 👈
He continued: “The decision to shut down services so quickly isn’t an overreaction – it tells you they suspect this could escalate into encryption or data theft.
“Councils hold incredibly sensitive material: social-care files, identity documents, housing records, everything you’d need for targeted fraud or extortion. If attackers got near that, the fallout wouldn’t stay local.
“The NCSC and Met being pulled in at speed shows this is being treated as a high-risk event, not an IT outage. And it should be.
“Local authorities remain some of the easiest public-sector targets because they’re running huge workloads on tight budgets with uneven cyber maturity.”
Sky News has approached Westminster City Council and Hammersmith and Fulham Council for comment.
The Metropolitan Police has also been approached for comment.