‘Real threat’ still posed by hackers says council subject to devastating cyber attack four years ago

Redcar and Cleveland Council suffered major disruption in February 2020 as a result of an attack on its IT network with hackers unleashing a virus via a suspect e-mail attachment that was inadvertently downloaded onto a work laptop.

The council was later compensated by the Government towards its costs with £3.68m worth of direct funding, although this fell short of the sum sought which was in excess of £11m.

A corporate risk assessment update provided for governance committee members noted: “Even though there are several controls in place, we are aware of regular successful attacks on other similar organisations and, therefore, [cyber attack] remains a real threat.”

It described how test ‘phishing’ e-mails were now being sent out to staff and councillors with those deemed to have interacted unsafely with the e-mails requested to undergo further cyber-security training.

The update said: “The phishing testing helps train staff to recognise phishing e-mails which are the most likely initial route of attack. This reduces the risk of these attacks being successful.”

The council recently appointed a new provider to carry out annual IT health checks to review the internal and external security of its IT infrastructure.

Following the 2020 attack, the council also adopted a revised “early warning system” provided by the National Cyber Security Centre – part of GCHQ – which monitors council systems for vulnerabilities and issues and sends alerts where they are found.

The update also said the council was taking part in a Ministry of Housing, Communities and Local Government project – the Cyber Assessment Framework – which aims to ensure that local authorities are following nationally recognised security standards.

While the attack on Redcar and Cleveland was one the worst seen in local government in recent years, threats have not gone away to the sector.

In the last month Middlesbrough Council was subject to two ‘distributed denial of service’ attacks in the space of a week which forced it to temporarily shut down its website.

Such attacks typically flood systems with superfluous requests disrupting normal operation.

The website was later restored with council chiefs reassuring residents that no services were affected and no council or personal data was compromised.

At the same time hackers thought to have sympathies with the current Russian regime claimed responsibility for attacks on Salford, Bury, Trafford and Tameside councils in the north west with Portsmouth Council stating it was similarly affected.

Last year former Redcar and Cleveland Council leader Mary Lanigan told a Parliamentary inquiry she had refused to pay a ransom demanded by criminals responsible for the 2020 attack.

Describing the impact, she said: “We lost everything, the whole lot, it was catastrophic. I had staff actually writing on pieces of paper, things that had not been done from decades before.

“We could not take in payments for rates or bills, we had no records or documents, we had no telephone service or e-mails, no functioning computers. The cost to the local authority was massive, we had to bring in external expertise and put new systems in.

“It took us eight and-a-half months to fully put things back together.”