Multiple London Councils Responding to Cyberattack

Several London city councils said they detected hacker activity on Wednesday night in an incident disrupting their telephone access and that may involve stolen data.

See Also: How UK government can continue to innovate while reducing tech costs

The municipalities of Westminster and Kensington and Chelsea said they “are responding to a cybersecurity issue” that could also affect the borough of Hammersmith and Fulham. The three neighboring boroughs share IT services.

“At this stage, it is too early to say who did this, and why, but we are investigating to see if any data has been compromised – which is standard practice,” the boroughs said in a joint statement.

A National Cyber Security Center spokesperson said the agency is aware of the incidents and is working with the councils to understand the full scale of the attack.

Since the hack and its spillover impact likely stem from interconnected systems, the attack could have been caused by a supply chain compromise, said Ian Nicholson, head of incident response at Pentest People.

Council networks often run on legacy systems with irregular patching schedules, making them relatively easy targets. “The real concern now, from my perspective, is data integrity and operational disruption. Local authorities sit on highly sensitive information, and incidents like this really do impact those much-needed frontline services,” Nicholson said.

Attackers could use stolen information for phishing attacks and scams, such as fraudulent fuel-payment schemes, warned Raghu Nandakumara, vice president of industry strategy at Illumio.

The disclosure from the councils follows a spate of high profile hacks targeting British retailers and car manufacturing giant Jaguar Land Rover, which cost the company $260 million (see: Jaguar Land Rover Hack Cost $260 Million).

These incidents have prompted concerns from British lawmakers, who called on the government to urgently prioritize cyber resilience across the British supply chain ecosystem (see: UK Parliamentary Committee Recommends Software Liability).

To address potential supply chain risks, the U.K. government this month introduced the Cyber Security and Resilience Bill that mandates incident response and mandatory patching of IT systems (see: UK Unveils Cyber Security and Resilience Bill).