Glasgow City Council reveals major data breach, critical systems offline

Glasgow City Council recently revealed a major data security incident that forced it to take several critical systems offline and potentially resulted in the theft of confidential data.

 

In a data security incident notice, Glasgow City Council officials said that on June 19, CGI, the council’s IT provider, discovered malicious activity on servers managed by a third-party service provider.

 

The council officials immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident. It also notified Police Scotland, the Scottish Cyber Coordination Centre (SC3) and the National Cyber Security Centre and is working with them to resolve the incident at the earliest.

 

The incident led the council to take several critical servers offline, disrupting various day-to-day digital and online services.

 

“The loss of web-based services has been caused by the isolation of the affected servers, rather than the cyber incident itself. This includes viewing and commenting on planning applications; paying penalty charges for parking or bus lane contraventions; reporting school absences, and ordering certificates from city registrars,” the council said.

 

“No council financial systems have been affected in this attack and no details of bank accounts or credit/debit cards processed by those systems have been compromised,” it added.

 

Glasgow City Council cannot confirm whether confidential data was compromised during the incident, but acknowledges the possibility of data theft from currently inaccessible web forms. As a result, it has reported the matter to the Information Commissioner’s Office (ICO).

 

The council added that citizens are currently unable to access planning applications, the SPF Online portal, call back appointments, and cannot make online payments, book registrations or submit online appeals.

 

Online forms and calendars for services such as permits, complaints, Freedom of Information (FOI) requests, public processions, and others are also unavailable.