ICO reprimands London Borough of Hackney over data security failings

The UK Information Commissioner’s Office has issued a reprimand to the London Borough of Hackney for failing to protect residents’ personal information during a 2020 ransomware attack.

In 2020, the Hackney council suffered a significant data security incident that compromised the sensitive personal information of Council residents. Philip Glanville, the then mayor of the council, said the Council worked with experts from the National Cyber Security Centre, external experts, and the Ministry of Housing, Communities and Local Government to investigate and understand the impact of the incident.

Recently, in a statement shared with the media, the Information Commissioner’s Office said that its investigation into the data security incident suffered by the Hackney Council has revealed a “lack of proper security and processes to protect personal data.”

“LBOH failed to ensure that a security patch management system was actively applied to all devices, and failed to change an insecure password on a dormant account still connected to Hackney council servers which was exploited by the attackers,” the information watchdog said.

Deputy Commissioner at the ICO Stephen Bonner termed the London Borough of Hackney’s data security failing a “clear and avoidable error.”

He said the incident resulted in a “mass loss of data and has had a severely detrimental impact on many residents. At its absolute worst, this has meant that some of the most deeply personal information possible has ended up in the hands of the attackers. Systems that people rely on were offline for many months. This is entirely unacceptable and should not have happened.

“If we want people to have trust in local authorities, they need to trust that local authorities will look after their data properly. Hackney residents have learnt the hard way the consequences for these errors – councils across the country should act now to ensure that those they are responsible for do not suffer the same fate,” he added.