A major cyber attack on a West London council has prompted warnings to 100,000 households that their personal information may have been stolen.
Council Confirms Criminal Data Breach
Kensington and Chelsea Council (RBKC) confirmed it was the target of an attack carried out with criminal intent in November 2025. The authority has now contacted a vast number of residents, urging them to be vigilant.
In an update on its website, the council warned that criminals could use the stolen data to make scams appear more convincing. Residents have been advised to follow National Cyber Security Centre guidance and to be wary of unexpected communications.
"We are urging residents to be cautious of unexpected calls, messages, links or attachments, or anyone claiming to be from the council asking for sensitive details," the council stated.
Long Recovery and Cross-Borough Impact
Council leader, cllr Elizabeth Campbell, warned that it could take months for services to return to normal. While the cybersecurity team detected and contained the breach "quickly," a thorough check of all accessed files is underway, with priority given to data belonging to vulnerable individuals.
The attack has had a wider impact, affecting shared systems with Westminster City Council and Hammersmith and Fulham Council. All three authorities are working with law enforcement and the National Cyber Security Centre to track the compromised data.
An internal memo at Westminster City Council, seen by the Local Democracy Reporting Service (LDRS), revealed that some council data was copied. It also advised staff to be "vigilant" on Microsoft Teams and warned that payments to suppliers are being delayed due to issues with finance systems.
A Growing Threat to Public Services
The council emphasised that such attacks are not uncommon for public sector bodies. In 2024 alone, the local government sector reported over 150 incidents to the Information Commissioner's Office.
RBKC stated it deals with cyber threats daily, having intercepted 113,000 phishing attempts between June and September 2025. The authority spends approximately £12 million annually on IT and security systems.
Despite these defences, the council acknowledged that stolen data could be misused or published. "We are planning accordingly for this, working with law enforcement at every step," its update read.
A spokesperson for Westminster City Council said the authority is "actively informing and supporting staff with guidance and resources to help them stay cyber secure."
