Stratford District Council reports data breach of residents' emails

The Stratford District Council (SDC) has publicly disclosed a data breach that resulted in the leak of residents' email addresses.

This incident came to light on November 20, and the council has since taken action by notifying the privacy regulator - the Information Commissioner’s Office and enlisting the aid of Warwickshire Police.

The breach appears to be limited to a specific database containing only email addresses provided by residents, with no current indication that additional personal data has been compromised.

Update - As of 19th of February 2024, the investigation revealed that approximately 79,000 email addresses from the garden waste collection database were compromised. An employee misappropriated these for the promotion of a non-council related business, according to officials. Warwickshire Police issued a caution to a former council employee for the intentional or negligent acquisition or release of personal data without the data controller's permission, a violation of the Data Protection Act 2018. This person, who is no longer with the council, has expressed regret for their actions, and all the improperly acquired information has been eradicated.

SDC has emphasized that this event seems to be a solitary occurrence and not indicative of broader systemic issues.

Unfortunately, SDC has not disclosed the nature of the data breach nor the number of affected individuals.

An exhaustive internal investigation is underway to ascertain the cause and full extent of the breach. The council is treating the matter with utmost seriousness, including issuing apologies to those impacted. The council has refrained from further commentary to preserve the integrity of the ongoing investigation.