Leicester City Council says ransomware group leaked 1.3TB of data stolen from its systems

Leicester City Council said this week that a known ransomware group that conducted a "highly sophisticated attack" on its systems has published around 1.3 terabytes of data that it stole from its network.

 

On March 7, Leicester City Council announced in a press release that it identified a cyber security incident that affected IT systems and phone lines. The Council said it launched an internal investigation with assistance from cyber security experts to identify the nature and scope of the incident.

 

The Council said it notified relevant law enforcement authorities about the incident and its officials contacted other city councils who suffered similar cyber security incidents in the past to learn more about how they responded to those incidents.

 

The cyber attack had affected most of the Council departments’ phone numbers. The Council said it acted quickly to commission alternative numbers for the affected departments, including adult social care, child protection, homelessness, community support grant crisis, housing repairs, registrars, school transport, environment and noise nuisance and property related issues.

 

While the council did not initially disclose the identity of the hacker group responsible for the security incident, the INC ransom group claimed responsibility for the cyber attack on April 3, listing the Council as a victim on its dark web site.

 

The group also claimed that it had in its possession up to 3 terabytes of data stolen from the Council’s systems and published samples of the stolen data to prove the authenticity of its claims.

 

Acknowledging the group’s claims, the Council admitted that the group had indeed stolen and published data stolen from its systems. “We have today been made aware that a small number of documents held on our servers have been published by a known ransomware group,” it said.

 

“This relates to the cyber incident identified by the council on 7 March, which led to us closing down our IT systems. At the moment we are aware of around 25 or so confidential documents that have been published online. They include rent statements, applications to purchase council housing and identification documents such as passport information,” said Richard Sword, Leicester City Council’s strategic director of city developments and neighbourhoods.

 

In a recent press release, Sword said that the ransomware group has published a fresh set of data stolen from the City Council’s systems.

 

“Cyber security and police experts working with the council informed us yesterday that another batch of stolen data had been published. At 1.3 terabytes, this is a much larger batch of data than the 25 documents published last week. We are in the process of reviewing the data to see exactly what it consists of, and have notified the Information Commissioner of our actions,” Sword said.

 

“We have a duty to inform anyone considered at high risk as a result of data breaches. Due to the amount of data published, we will be prioritising people who may come under this category. We realise this data breach will cause concern, and apologise for any distress caused,” he added.

 

The City Council is closely working with Leicestershire Police and the National Cyber Security Centre to investigate the incident and identify individuals who were affected by the breach.