February 13, 2025

Hackney Council downplays data breach in disagreement with privacy regulator

In October 2020, Hackney Council experienced a devasting cyberattack that compromised the personal data of approximately 280,000 individuals and disrupted many of its services. The breach was so significant that it is still affecting the council over four years later.

Following an investigation into the cyberattack, the Information Commissioner’s Office (ICO) identified serious security failures within the council’s systems and reprimanded the local authority for its poor data security processes. However, Hackney Council has challenged these findings.

What is the ICO?

The ICO (Information Commissioner’s Office) is the UK’s independent regulator for data protection and privacy rights. It enforces the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, ensuring organisations handle personal data responsibly and securely.

The ICO has the power to investigate data breaches, issue fines, and take enforcement action against companies and public bodies that fail to protect people’s personal information. While it often imposes significant fines for serious security lapses, in some cases, it opts for a reprimand – a formal warning highlighting failures without financial penalties.

What did the ICO’s investigation into the Hackney Council find?

The ICO’s investigation found serious security failures in Hackney Council’s IT systems, which made it easier for hackers to access and encrypt sensitive data.

The watchdog determined Hackney Council had:

Failed to keep IT systems updated with the latest security patches – making them vulnerable to cyberattacks.
Allowed dormant accounts with weak credentials to remain active – one of which was exploited by hackers.
Not implemented adequate security measures to prevent unauthorised access to residents’ personal information.

Despite these findings, the ICO chose to reprimand Hackney Council rather than issue a fine. This decision has raised questions about whether the council has been held accountable properly, considering the severity of the breach and the risk it posed to thousands of residents.

What was Hackney Council’s response?

Despite getting off without having to pay a fine, Hackney Council expressed disagreement with the ICO’s conclusions. It denied breaching its security obligations, arguing that the ICO had misunderstood the facts, misapplied the law, and exaggerated the risk to residents’ data.

Hackney Council stated:

“While we welcome the ICO completing its investigation, we maintain that the Council has not breached its security obligations. We consider that the ICO has misunderstood the facts and misapplied the law with respect to the issues in question, and has mischaracterised and exaggerated the risk to residents’ data.”

A council spokesperson emphasised the complexity of modern IT systems and the evolving nature of cyber threats. They highlighted the council’s ongoing efforts to collaborate with national cybersecurity agencies and invest in modern, secure systems to protect public services.

Nevertheless, the council also refused to challenge the ICO’s decision, stating:

“It was not in our residents’ interests to use our limited resources to challenge the ICO’s decision.”

Reaction from the public and legal experts

Many legal experts disagree with Hackney Council’s bullish defence. While there is support for its focus on future cybersecurity improvements, critics argue that downplaying the ICO’s findings undermines the severity of the breach and its impact on affected individuals. If a private company had suffered a similar attack and failed to secure sensitive data, it would likely have faced a substantial fine rather than just a reprimand.

What are the risks for Hackney residents?

The long-term risks for Hackney residents affected by this data breach should not be ignored. Even though the attack happened in 2020, stolen personal data can still be used for fraud, identity theft, and online scams. In some cases, criminals hold onto stolen data for months or years before selling it or using it maliciously.

Potential risks include:

Identity theft – fraudsters could open credit accounts or take out loans in a resident’s name.
Targeted phishing scams – criminals may use stolen data to impersonate trusted organisations (such as banks or councils) and trick residents into revealing more information.
Financial fraud –bank details stolen in such scams may be used to attempt unauthorised transactions.
Exploitation of sensitive personal information – details about race, religion, health, or criminal records could be misused or exposed.

These risks make it crucial for affected residents to remain vigilant, monitor their bank accounts, and watch out for suspicious activity. However, the emotional toll of this constant vigilance should not be underestimated. The anxiety of knowing your personal data could be misused at any time can lead to stress, loss of trust in institutions, and a feeling of helplessness, particularly for those already in vulnerable situations.