Yes, they do, and more frequently than you might think. Cybercriminals have shown repeatedly that they love data, and the more sensitive it is the more money they can extort if they steal, encrypt, or restrict access to it. Local governments hold millions of gigabytes of this type of data – including financial and legal information, sensitive planning details, confidential medical data, data relating to children at risk and even vulnerable women – including locations of domestic violence refuges.

The UK Government said that around 40 percent of incidents managed by the National Cyber Security Centre between September 2020 and August 2021, were aimed at the public sector. In 2020, both Redcar & Cleveland councils were hit by ransomware attacks, costing millions, and impacting services including council tax, benefits and housing waiting lists. Gloucester City Council was hit by a fresh cyber-attack in December 2021, following a previous one in 2014.

And poor cyber security has led to numerous high-profile attacks against other councils in the past few years. The London Borough of Hackney was subject to a ransomware attack in 2020 in which personal staff and customer data was released, land registry information was scrambled, and local authority payments had to be halted. Some of the personal data stolen was so sensitive and high-risk that it led to a year-long police operation to try and mitigate the threats to individuals caused by its loss and subsequent publication.

As more services go online and information becomes digitized the challenges faced by local governments and the solutions to the areas of attack become more complicated. But a key part of any local government strategy is ensuring that you understand the risks in your own organisation and deal with them accordingly. As Maya Angelou once famously said, “Hoping for the best, prepared for the worst….”

So, what is ransomware?

Simply put this is a malicious attack against a network where the criminals get access to data and either steal it, threaten to delete it, or encrypt it. The criminals will then demand a payment for the return of the data. Imagine how this could affect your business – sensitive financial data relating to your customers, suppliers or even your own company, commercially sensitive data relating to staff, the operating of your business or contacts with others - these could all be compromised or lost.

The reality is that ransomware is now viewed as a business model and many entities behind these attacks will present themselves as being on the same side as the victim. So, in return for the payment your business will often be supported through a process which will return the data that has been encrypted / stolen. It is worthy of note that paying the ransom does not guarantee the return of the data and certainly does not guarantee that it won’t be sold on or published at some point in the future. Also, your network will still be infected, and you are more likely to be targeted again in the future.

The paying of the ransom has moral and ethical undertones that may not be immediately apparent when you are faced with such an attack. Consider the fact that you may be financially supporting terrorists or criminals by paying the ransom.

Can you protect yourself from these attacks?

Ransomware is always preceded by an attack on the network itself, commonly through use of stolen credentials, a phishing e-mail or brute force attack. These attacks are increasing in complexity and sophistication meaning that defence against these dark arts needs continual review. But the key points for protection to remember are:-

1. Look at the free tools and guidance available on the ECRC site Education & Resources at the Eastern Cyber Resilience Centre
2. Make your network resilient and practice good cyber hygiene – using Cyber Essentials (CE) principles. Use strong passwords and multi-factor authentication if you can. You can find the link to the education specific CE process on our website.
3. Make sure Staff Awareness Training is up to date – spotting a phishing e-mail early will prevent a lot of pain further on down the line.
4. Make sure all staff know the symptoms of an ongoing ransomware attack and respond quickly to it using a prepared incident response plan. You can download a template from our site.
5. Identify common points of failure across the network – patch vulnerabilities and restrict access from malicious sites and IP addresses – speak with you MSPs about this and don’t assume that it will be done automatically. The important thing here is to understand where your main vulnerabilities are, then deal with them first.

What next?

The impact of a successful attack against your website or network can be catastrophic and lead to website downtime, loss of data and permanent loss of reputation. But all is not lost.

Here at the centre, we would recommend that you consider:-

1. Join our community for free by clicking here. You will be supported through implementing the changes you need to make to protect your organisation.
2. Consider how we can help your own supply chain and customers – it would be great if you could look at promoting the centre on our behalf. Again – contact us to find out more.

Reporting a live cyber-attack 24/7

If you are a business, charity or other organisation which is currently suffering a live cyber-attack (in progress), please call Action Fraud on 0300 123 2040 immediately. This service is available 24 hours a day, 7 days a week.

Reporting a cyber-attack which isn't ongoing

Please report online to Action Fraud, the UK's national reporting centre for fraud and cybercrime. You can report cybercrime online at any time using the online reporting tool, which will guide you through simple questions to identify what has happened. Action Fraud advisors can also provide the help, support, and advice you need.

Alternatively, you can call Action Fraud on 0300 123 2040 (textphone 0300 123 2050).