A major London council has confirmed that hackers likely accessed and copied potentially sensitive personal information belonging to residents during a significant cyber attack.
What Happened in the Cyber Attack?
Westminster City Council was one of three local authorities targeted in an assault on its IT systems on 24 November. The council detected unusual activity and responded by immediately shutting down its network to contain the threat.
The breach involved a shared IT system used in partnership with Kensington and Chelsea Council. While described as involving "limited data," officials have stated that the information taken was likely personal and could be sensitive. Crucially, the council has confirmed the data was not lost or deleted, and there is currently no indication it has been published online.
Ongoing Investigation and Impact on Services
A substantial investigation is now underway to determine the precise nature of the stolen details and how many residents are affected. Westminster Council is working with the Metropolitan Police, the National Crime Agency, the National Cyber Security Centre (NCSC), and experts from NCC Group.
Council services have been significantly disrupted, and restoring them fully is expected to take time. The council has published a list of affected services on its website. Kensington and Chelsea Council, which announced its own breach days after the attack, has warned it could take "months" for its operations to return to normal.
Cllr David Boothroyd, Cabinet Member for Finance and Council Reform, sought to reassure the public. "I want to reassure residents that we are doing everything possible to respond effectively," he said. "Our priority is to support and protect the most vulnerable in our community, despite the disruption."
Advice for Residents and How to Get Help
The council is urging all residents to be extra vigilant against unexpected phone calls, emails, or text messages, following official guidance from the NCSC.
For those with concerns, a dedicated support line and email address have been established:
- Helpline: 0207 641 1919 (Open Monday, Tuesday, Thursday, Friday: 9am-5pm; Wednesday: 9am-4pm)
- Email: cyberenquiry@westminster.gov.uk
The third council involved, Hammersmith and Fulham, has stated that, to date, there is no evidence its systems were compromised. All three authorities share IT infrastructure to varying degrees. A full review of the incident is promised by Kensington and Chelsea's leadership "when the time is right."
