Breaking: London councils suffering cyber attacks

Westminster, Hammersmith & Fulham and Kensington & Chelsea affected

Westminster, the Royal Borough of Kensington & Chelsea (RBKC) and Hammersmith & Fulham councils have all reported IT issues in the last 48 hours.

All named councils are suffering suspected cyber attacks, with Westminster City Council says people are struggling to get in touch. The BBC’s Local Democracy Reporting Service (LDRS) has seen an internal memo saying the council has shut down all of its networks as a precautionary measure, following a “cybersecurity incident.”

The council wrote on X that it was experiencing “a serious IT issue” and is “working internally with our partners” to resolve it.

According to sources speaking to the LDRS, some RBKC council systems have been down for two or three days at this point.

Hammersmith & Fulham Council posted a similar memo, saying it was responding to a cyber incident.

Both the National Cybersecurity Centre and the Metropolitan Police have been informed, showing the councils are treating this as an attack rather than a simple IT outage.

London Mayor Sadiq Khan said, “We are trying to encourage councils to have better resilience but the reality is, I'm afraid, those who breach protections are going to try more and more ways to get into those systems. We're going to make sure we're resilient, that means making sure we have the right safeguards in place.”

Graeme Stewart, head of public sector at Check Point, told us that taking out a London council is much more than just a nuisance - “It’s a direct hit on the people who rely on social care, housing support and safeguarding teams to keep them safe.

“When these systems stall, the impact lands on residents who have no buffer.”

Ian Nicholson, Head of Incident Response at Pentest People, called out the fragility of connected systems:

“The report...goes to prove how fragile shared public-sector infrastructure can be. When environments are completely interconnected, compromise in one area quickly propagates across the whole environment. Think supply chain attacks. Again and again, we see attackers exploiting legacy systems, we see slow patching and underfunded, understaffed IT teams.”

Hackney Council suffered a serious cyber incident in 2020, which affected about 280,000 residents and staff.

The ICO reprimanded the council over the incident last year, finding examples of a lack of proper security and processes to protect personal data.

Update 16:20, 26/11/2025: An earlier version of this story said Hackney Council was affected by the above incidents. A spokesperson for the council confirmed to us that this was not the case, but the authority has emailed staff as a precaution urging them to be aware and to protect residents’ data.