Leicester City Council - Cyber Incident

[Edu-IT]

Another council hit!

 

https://www.ukauthority.com/articles/leicester-city-council-hit-by-cyber-incident/

 

Leicester City Council has said it will take at least until the middle of this week to get its IT systems and phone lines running again following a cyber incident.

It said the incident, so far unspecified in nature, took place on Thursday of last week.

[Sonic007]

Looking at how the clowncil is currently run, it doesnt suprise me.

[HPlum78]

This is also affecting a number of schools around Leicestershire an all, my guess is that their is some shard service and because the council has taken some action its had an impact on those schools as well.

 

All the schools in the Embrace Trust seem to be impacted:

https://www.embracemat.org/

 

All of the individual websites have a banner on them that refer to ongoing IT issues.

Edited March 13, 2024 by HPlum78

[jmak]

Looking at how the clowncil is currently run, it doesnt suprise me.

I'm moving from my view of the two statuses of hacking being

 

1) I have been hacked

2) I will be hacked

 

to

1) I know I've been hacked

2) I don't know yet that I've been hacked

 

Of course some organisations are more vulnerable and less competently managed than others, but I wouldn't assume that because someone got hacked they're incompetent.

[Edu-IT]

This is also affecting a number of schools around Leicestershire an all, my guess is that their is some shard service and because the council has taken some action its had an impact on those schools as well.

 

All the schools in the Embrace Trust seem to be impacted:

https://www.embracemat.org/

 

All of the individual websites have a banner on them that refer to ongoing IT issues.

I don’t think its related to Leicester City Council. Just similar timing.

 

Based on:

 

On Friday we became aware of some unusual IT issues at our school.

 

While we are still looking at the cause of these, given that Leicester City Council has been dealing with a “cyber incident”, we felt it was prudent to be very cautious in our response.

[ITGURU]

one reason why our phone lines and phone system are on separate broadband/vlan. when we got attacked the Linux server was not encrypted so could still use phones.

[MartinT]

one reason why our phone lines and phone system are on separate broadband/vlan. when we got attacked the Linux server was not encrypted so could still use phones.

We had the opposite impact last year when our Linux server for the phones acquired some malware which was saturating the gamma line with bad packets making phone callers sound like Daleks. It took us a while to track that one down, which of course didn't affect our main internet leased line.

[Arthur]

Cyber incident update: 3 April 2024

 

The city council's strategic director of city developments and neighbourhoods has provided an update on the cyber incident that was identified on 7 March.

 

“We have today been made aware that a small number of documents held on our servers have been published by a known ransomware group," said Richard Sword, Leicester City Council's strategic director of city developments and neighbourhoods.

 

“This group is known to have attacked a number of government, education and healthcare organisations.

 

“This relates to the cyber incident identified by the council on 7 March, which led to us closing down our IT systems.

 

“At the moment we are aware of around 25 or so confidential documents that have been published online. They include rent statements, applications to purchase council housing and identification documents such as passport information.

 

“The breach of confidential information is a very serious matter and its publication is a criminal act. We are in the process of trying to contact all of those affected by this breach, and have also notified the Information Commissioner.

 

“We realise this will cause anxiety for those affected, and want to apologise for any distress caused.

 

“At this stage we are not able to say with certainty whether other documents have been extracted from our systems, however we believe it is very possible that they have.

 

“We are continuing to work with the cyber crime team at Leicestershire Police and the National Cyber Security Centre as part of this ongoing criminal investigation.

 

“As this is a live investigation we are not able to comment in further detail, but will continue to give updates when we have news to share.”

 

Most of the council’s systems and phone lines are now back operating as normal after the council shut them down on 7 March. There is no reason for concern about conducting business as usual with the council.

 

The council is encouraging its staff and the public to be on their guard for any attempt to access their systems or approaches from anyone claiming to be in possession of data relating to them.

 

If anyone is approached by someone claiming to be in possession of data relating to them, they should report this to Leicestershire Police on 101 or online here

 

Advice to individuals and their families on how to protect themselves from the impact of data fraud is offered by the National Cyber Security Centre here

 

The council has published some FAQs about the cyber incident on its website