Local authority acknowledges breach of citizens’ sensitive data and indicates that it was targeted by a cyber gang that has also ‘attacked a number of government, education and healthcare organisations’

Almost a month after suffering a “cyber incident”, Leicester City Council has revealed that it was targeted by ransomware attackers – who have published citizens’ sensitive information online.

An update released yesterday disclosed that the authority has “been made aware that a small number of documents held on our servers have been published by a known ransomware group”, according to strategic director of city developments and neighbourhoods Richard Sword

“At the moment we are aware of around 25 or so confidential documents that have been published online,” he said. “They include rent statements, applications to purchase council housing and identification documents such as passport information. The breach of confidential information is a very serious matter and its publication is a criminal act. We are in the process of trying to contact all of those affected by this breach, and have also notified the Information Commissioner. We realise this will cause anxiety for those affected, and want to apologise for any distress caused.”

Sword added: “At this stage we are not able to say with certainty whether other documents have been extracted from our systems, however we believe it is very possible that they have. “We are continuing to work with the cybercrime team at Leicestershire Police and the National Cyber Security Centre as part of this ongoing criminal investigation. As this is a live investigation we are not able to comment in further detail, but will continue to give updates when we have news to share.”

Related content

• Capita admits possible compromise of customer data during cyberattack
• Hebridean council works on data recovery following cyberattack
• Cyber Security Week: Analysis – how and where are attackers getting in?

The cyber gang that targeted Leicester has also “attacked a number of government, education and healthcare organisations”.

In the immediate aftermath of the incident on 7 March, the council shut down its IT systems and phone lines as a precautionary measure, and warned that fully restoring services could take several weeks.

Just before Easter, the authority announced that its “main service portals are now back online”. This includes its My Account platform enabling residents to access services related to waste and recycling, school admissions, birth registration, and licensing, as well as discrete portals for planning applications, parking permits, and bids for council housing. Telephone helplines for social care, housing and homelessness, and electoral services have also been restored.

This week marked the twice-weekly reopening of a customer service facility in the city centre, while leisure centres are also fully operational and public computers and WiFi are available libraries.

The council hopes to restore any outstanding systems and services in the coming days and, in the meantime, advised citizens that “there is no reason for concern about conducting business as usual with the council”.