Hackney Council reprimanded over 2020 ransomware attack

Special category data

During the course of its investigation, the ICO said it found the encrypted information to include information on protected category data under UK GDPR, including information on racial and ethnic backgrounds, religious beliefs, sexual orientation, health data, economic data, criminal offence data, and names and addresses.

The Pysa gang subsequently leaked some of the council’s data, including personally identifiable information (PII) including passport data, scans of tenancy audit documents, staff data and community safety information. The ICO said a total of 9,605 records were exfiltrated and posed a meaningful risk of harm to 230 people.

“If we want people to have trust in local authorities, they need to trust that local authorities will look after their data properly,” said Bonner. “Hackney residents have learnt the hard way the consequences for these errors – councils across the country should act now to ensure that those they are responsible for do not suffer the same fate.”

Swift and comprehensive action

In its judgment, the ICO said Hackney Council had got some things right. It took “swift and comprehensive action” to mitigate the attack as soon as it became clear what was happening, said Bonner, and engaged positively with bodies such as the National Cyber Security Centre (NCSC), the National Crime Agency (NCA) and London’s Metropolitan Police force.

The ICO also praised Hackney Council for effectively engaging with residents and keeping those deemed at significant risk informed throughout.

It also acknowledged that the council had been to some extent aware of the core vulnerabilities that led to the ransomware attack, and had been on a path to improving its patch management policies with a new system. The ICO further praised the council’s overall governance structures, policies, improvement plans, and training and development of staff in the wake of the attack, as well as the introduction of a new zero-trust security policy.

In issuing its reprimand, as opposed to a fine, the ICO also noted the impact Covid-19 had had on resources at local authorities at the time of the attack.

“There is a vital learning from this for both Hackney and for councils across the country,” said Bonner. “Systems must be updated; you have to take preventative measures to reduce the risk and potential impact of human error and you must ensure that data that is entrusted to you is protected.”

Hackney Council disputes findings

However, in the wake of the ICO’s judgment, both Woodley and Hackney Council hit back, saying they disputed a number of the regulator’s findings. They said they maintained that the council had not breached its security obligations, and accused the ICO of misunderstanding the facts and misapplying the law, as well as mischaracterising and exaggerating the risk to residents’ data.

A council spokesperson said: “However, we do not believe it is in our residents’ interests to use our limited resources to challenge the ICO’s decision. Instead, we will continue to work closely with the National Cyber Security Centre, central government and colleagues across local government and the wider public sector to play our part in defending public services against the ever increasing threats of cyber attack and to help ensure the safety and well-being of our residents.

“Modern IT systems are extremely complex and cyber threats continue to grow,” they continued. “Since 2020, organisations of all sizes in the public and private sector have fallen victim to criminals deploying ever more complex and sophisticated modes of cyber attack. To meet this rapidly changing threat, we have been investing and rebuilding our systems to further accelerate the delivery of our strategy of using the most modern and secure systems possible.”