Shetland Islands council confirms data breach of council tax debt data

Shetland Islands Council (SIC) has confirmed a data breach involving the personal information of 130 individuals who were in council tax debt last year. 

The breach was reportd by a campaigner Stuart Hill who sent letters to more than 100 people on Tuesday, informing them that he had obtained a list of people who were served with summary warrants in July 2024 due to outstanding council tax debts.

The council has stated that its initial investigation confirms the breach occurred, though it emphasized that no financial information was leaked. According to SIC's statement released on Friday, the incident "had not come as a result of a cyber attack or a phishing exercise," though the council did not disclose exactly how Hill gained access to the sensitive information.

In his letters to affected individuals, Hill claimed that the data breach demonstrated poor "data security at the Shetland Islands Council." He assertes that there were sitting councillors among those on the list of debtors. Hill used the communication to promote his political views, stating that the SIC has "absolutely no authority" to charge council tax, and invited recipients to join what he refers to as the "Sovereign Nation of Shetland."

The council has announced it will be reporting the data breach to the UK's Information Commissioner's Office (ICO), the national data protection regulator. "The ICO's responsibility is then to decide if the council did enough to prevent the breach in the first place," the council explained in its statement.

SIC is currently in the process of contacting all affected individuals, either by telephone or letter.

The total number of affected individuals has been confirmed as 130, though the exact nature of how the breach occurred and what specific preventive measures are being implemented remain undisclosed.