In October 2020, Hackney Council experienced a significant cyber-attack that compromised the personal data of approximately 280,000 individuals, including local residents and staff. The Information Commissioner’s Office (ICO) – which is the UK’s data protection watchdog – has since conducted an investigation into the breach, revealing serious security failures within the council’s systems.
What did the ICO have to say about the Hackney Council data breach?
The ICO’s investigation uncovered that hackers accessed and encrypted around 440,000 files, some of which contained sensitive personal information such as:
- Racial or ethnic origin
- Religious beliefs
- Sexual orientation
- Health data
- Economic data
- Criminal offence data
- Basic personal identifiers like names and addresses
Identified security failures
The ICO identified critical lapses in Hackney Council’s data protection measures, including:
- Inadequate patch management: The council failed to ensure that security patches were consistently applied across all devices.
- Dormant accounts with weak credentials: An inactive account with an insecure password remained connected to the council’s servers, which the attackers exploited.
Commenting on the breach, Stephen Bonner, Deputy Commissioner at the ICO, stated:
“This was a clear and avoidable error from London Borough of Hackney, one that has resulted in a mass loss of data and has had a severely detrimental impact on many residents. At its absolute worst, this has meant that some of the most deeply personal information possible has ended up in the hands of the attackers.”
The council said it did not accept the ICO’s findings and that it had not violated its security obligations.
Will Hackney Council have to pay a fine?
Despite the severity of the breach, Hackney Council has not been fined by the ICO. Instead, it has been issued with a formal reprimand. So, while the council has been criticised for its security failings, it will not face financial penalties.
This decision has sparked concerns about whether Hackney Council has gotten off lightly. With thousands of residents affected and highly sensitive data compromised, many believe that stronger action should have been taken to hold the council accountable. While a fine would not undo the damage, it would serve as a deterrent to other councils and organisations handling vast amounts of personal data.
But it is not too late to hold the council responsible. Data protection laws exist to ensure organisations take the necessary steps to safeguard personal information. If they fail in this duty, those affected have the right to seek justice and make a compensation claim.
Claim no-win, no-fee compensation for the Hackney Council data breach
If your personal information was breached in the Hackney Council data breach, you could be entitled to compensation. Holding organisations accountable for poor data security is crucial, and you have the right to seek redress if your data has been compromised.
Check your eligibility today. It’s fast, free, and there is no obligation to proceed.
