Royal Borough Kensington and Chelsea admits data “copied” in cyberattack

Warns residents to be alert for follow up attacks

The Royal Borough of Kensington and Chelsea confirmed that data has been exfiltrated from its systems in a cyberattack that was first reported last week.

The Royal Borough of Kensington and Chelsea (RBKC) confirmed on Friday that residents’ data may have been compromised in a cyberattack on an IT service provider.

RBKC issued the update on Friday.

“After discovering unusual activity first thing Monday morning, we have been taking all necessary steps to shut down and isolate systems and make them as safe as possible,” the updated statement said.

“We have now obtained evidence on our systems that shows some data has been copied and then taken away. At this moment in time, we believe the breach only impacts historical data.”

The statement emphasises that the data hasn’t been encrypted, that the council still has access to it and that “it has not been stolen.”

But the data has been stolen, and whilst the fact that the council still has access to it is positive, the fact that the council does not presently know who else does, is very much a negative. As the statement explains:

“..it is possible it could end up in the public domain. As a priority we are checking if this contains any personal or financial details of residents, customers, and service users – but this will take some time.”

Whilst investigation is ongoing, the council is now urging residents to vigilant with spotting attacks which may use the stolen data to phish for more lucrative data like credit card numbers or to perpetrate other socially engineered fraud attacks. Phishing attacks like these could take place via email, text or phone calls, the council warned.

In addition to explaining to residents why they now had to be on guard against email, text or phone-based attacks, RBKC also revealed that residents could expect at least two weeks more disruption to council services.

“We will do our very best to answer any urgent enquiries and have some phone lines up and running. Please understand our staff may not have all the answers at this point in time,” it said. “We are unable to access many of our systems, so will do our best to answer your enquiry if you do have an emergency.”

RBKC does not explain why, if it has access to all the data it says was copied in the attack, it is unable to access its systems.

The same attack also hit Westminster City Council and Hammersmith and Fulham local authority, both of which share IT services with RBKC.

“We are working closely with them both to investigate the full nature of the data breach that has been identified by the Royal Borough of Kensington and Chelsea on Friday 28 November, with whom we share some services, in order to assess what impact this may have on Westminster,” said Westminster City Council.

Hammersmith and Fulham (H&F) council said in updates over the weekend that it had taken steps to “isolate and safeguard” its networks and that currently “there is no evidence of H&F systems being compromised.” An update today says “My Account and some of our other online systems are temporarily unavailable”