Multipe UK local government councils hit by service provider breach
Learn More
The Information Commissioner's Office (ICO) in the UK is investigating a data breach involving three Kent councils - Canterbury, Dover, and Thanet - following a cyberattack that disrupted their online services. Initially, there was no indication of customer data being compromised, but the ICO later confirmed receiving breach reports from these councils. The attack's source seems to be East Kent Services (EKS), a shared IT and HR service provider for the councils, outsourced to Civica in 2018.
- Canterbury City Council: Their online payment systems, managed by EKS, are currently down. This has affected various services, including online applications, reporting, and maps, though payments like council tax, rent, or business rates are still operational.
- Dover District Council: This council is experiencing technical issues, particularly with their benefits and tax portals.
- Thanet District Council: They are facing difficulties with online forms and planning applications and have restricted access to some online systems due to security concerns.
There is no detailed information available on the nature of the attack, the extent of the data breach, or the number of individuals affected. The councils and relevant authorities are working to resolve the situation and mitigate its impact.
The incident can be related to the downtime of EKS's Pulse Secure VPN server, indicating potential vulnerabilities in widely-used corporate VPN systems. This connection, however, remains speculative.
Both Canterbury and Thanet councils have clarified that their IT services are not managed by Civica, which only handles their revenues, benefits, debt collection, and customer services. Civica, on its part, claims that the incident did not originate from its systems and expressed willingness to assist the affected councils and minimize the impact on citizens.
