A CYBER attack against the council in August resulted in "significant" disruption.

A report on the incident will come before the cabinet at its meeting on Wednesday.

It states, that between August 17 and 21, the council was the victim of the cyber incident, which resulted in data being "stolen and exported to an external digital services and storage point, referred to as the cloud".

The report says that the attack resulted in "significant internal organisational disruption"with many staff and teams impacted by the loss of key systems, although these were quickly restored and business as usual largely continued with "work arounds in place".

Furthermore, it says the council activated business continuity arrangements and technical response teams, who worked quickly to identify the source and contain the attack.

Recovery plan

The incident was "successfully contained" by August 21 and a recovery plan put in place, according to the report.

It adds: “The attack resulted in significant internal organisational disruption with many staff and teams impacted by the loss of key systems, although these were quickly restored and business as usual largely continued with work arounds in place.

“Throughout the incident, the council liaised with multi agency stakeholders to manage the response and recovery including the Department for Levelling Up, Housing and Communities, the Information Commissioner’s Office (ICO) and the Department for Work and Pensions (DWP).

“The data loss was reported to the ICO in line with expected timescales and further to internal investigation, the ICO have confirmed that they are satisfied with the outcome and will not be pursuing enforcement.

'Precursor to bigger cyber incident'

“Post incident investigation has suggested that the attack may have been a precursor to a much more substantial cyber event with potentially greater implications in terms of data loss and financial demands. The successful response and recovery process limited the impact substantially for both the organisation and service users.

“However, the council remains in an extended period of recovery with a full post incident action plan to ensure return to full business as usual.

"Lessons learned will be used to inform the next steps and future improvements to enhance security and limit the potential for similar attacks in future.”

The cabinet is recommended to note the report and the proposed next steps to ensure the future security of the council’s systems and associated data.