Data possibly stolen and council services offline after Glasgow cyber attack

Key Points

Glasgow City Council has been hit by a cyber incident
Council’s response assumes customer data may have been stolen
Anyone contacted by someone claiming to have their data told to contact police
Anyone who has used affected forms urged to be cautious about any contact claiming to be from the council
Council investigating alongside police and the National and Scottish cyber security centres
Glasgow City Council apologises for ‘anxiety and inconvenience’

Glasgow City Council has warned that personal data may have been stolen in a cyber attack affecting its services.

The local authority was alerted to malicious activity on servers managed by a third-party supplier on June 19.

Due to affected servers being taken offline, a number of services are currently unavailable, including planning applications, paying parking or bus lane fines, and ordering certificates.

Household schedules for bin collections, permits, and complaints are also impacted.

The council has said that no financial systems have been affected and no details of bank accounts or credit/debit cards processed by those systems have been compromised.

Police Scotland, the Scottish Cyber Coordination Centre (SC3), and the National Cyber Security Centre are working alongside the council to investigate the incident.

Stock image of cyber attack, system hack.

Scotland

Are we doing enough to prevent cyber attacks?

A number of high-profile ransomware incidents have taken place in the last few weeks, targeting supermarkets such as Marks and Spencer and Co-op.

Security specialists have confirmed that the incident was not caused by email, and that email communication with the council remains safe.

Anyone who has used any of the affected forms is being asked to be “particularly cautious” about any contact from individuals claiming to be from Glasgow City Council.

Bank account details, passwords or other secure information shouldn’t be sent through email.

A number of public bodies have suffered similar breaches, including West Lothian Council and NHS Dumfries and Galloway. In both those cases, personal and sensitive data was stolen.

Anyone contacted by someone claiming to have their data is asked to contact Police Scotland on 101 or call the Cyber Incident Response Helpline on 0800 1670 623.

Service impact

Planning – access to online planning applications is unavailable
Penalty Charge Notices – citizens are unable to access contravention evidence, make payments or submit online appeals
Pensions – members are unable to access the SPFOnline portal
Registrars – citizens are unable to book appointments online
Revenues and Benefits – citizens are unable to book callback appointments online

The following online forms and calendars are also unavailable: