Neighbouring Kent councils hit by simultaneous cyber attacks

Three local authorities in Kent – Canterbury City Council, Dover District Council and Thanet District Council – have fallen victim to near-simultaneous and potentially linked cyber attacks, knocking multiple public-facing systems across Kent offline.

All three authorities are understood to be working alongside the National Cyber Security Centre (NCSC) on incident response and remediation.

In the case of Canterbury, Computer Weekly understands services including its planning department, online forms and maps have been taken offline, while Dover residents have lost access to online forms, and Thanet also appears to have lost its planning department and online forms.

In a coordinated statement, Canterbury and Dover’s councils said: “Our teams are taking a precautionary approach while we work hard to investigate the problem and to minimise any disruption to our services.

“Our email system and website have been available throughout, although some parts of the website may not quite work as intended. We are sorry for any inconvenience people may have experienced over the past few days, and will provide updates as and when we have them.”

A spokesperson for Thanet Council told reporters it had proactively limited access to its online systems following reports of an incident.

The precise nature of the attacks remains undisclosed, although they do bear some hallmarks of a ransomware incident. In this instance, the facts of the three victims’ proximity to one another, and the similar nature of the services impacted, indicate the attacks may share a common thread.

Stephen Robinson, senior threat intelligence analyst at WithSecure, said the three councils share a number of systems as part of the East Kent Services [EKS] shared services vehicle, and suggested it was likely that this was where the incident originated, which gives an indication of what services may have been affected and what data may have been accessed.

“Service providers ... are regularly targeted to enable what is known as a supply chain attack, where compromising a single service provider allows an attacker to compromise all of their customers at the same time, for a far more devastating and impactful attack,” said Robinson.

Canterbury, Dover and Thanet first came together to set up EKS in 2011, and entered into entered into a partner relationship with to Civica in 2018 in a seven-year deal to run revenues, benefits, revenues, customer contact and debt recovery services that aimed to realise over £5m in savings, and saw over 200 employees from all three affected councils transfer to a central hub. This contract, which is not being extended beyond January 2025, does not cover any IT services, and a Civica spokesperson confirmed to Computer Weekly via email that the incident was not caused by any of the contractor's systems.