Everything you need to know about last week’s cyber attack on three London councils
Three London councils were the target of a cyber attack last week which is believed to have resulted in residents’ details being ‘copied and taken away’. Kensington and Chelsea Council, Westminster City Council and Hammersmith and Fulham Council said they have teamed up with cyber crime agencies to assess the extent of the hack and to bring systems back online.
All three councils have warned of “significant disruption” to services and said systems won’t be up and fully running for some time. All three local authorities share some IT services and systems with the issue understood to have originated at Kensington and Chelsea.
In the meantime, the Local Democracy Reporting Service (LDRS) has put together a handy guide on the latest advice from each council.
What’s the latest and who has been affected?
Kensington and Chelsea Council said it has evidence showing some data on its systems has been copied and taken away. The West London council believes the breach only impacts historical data and stressed it still has access to the information, that it hasn’t been stolen and that “it is possible it could end up in the public domain,” according to an update on its website.
The council said it’s checking if the data includes any personal or financial details of residents, customers, and service users but warns this will take some time. It urged people to be extra vigilant when called, emailed or sent text messages and shared links to advice from the National Cyber Security Centre (NCSC). These include advice on keeping your data safe and what to do if you’re worried about this breach .
The council urged people who purchased something from them, such as a parking permit, to make sure their bank and card details are safe and secure and to be on the look out for suspicious activity.
The council said it has started to bring systems and services back online but expects at least two weeks of “significant disruption”. It said it is working with the Met Police and crime agencies on an investigation to establish who did this, why and to bring them to justice.
The incident is being investigated by the National Crime Agency with the Information Commissioner’s Office (ICO) also informed.
In an update on its website Hammersmith and Fulham Council said it was able to isolate and safeguard its network following the cyber attack. The council added while there is no evidence of its systems being compromised it has temporarily suspended some applications, such as My Account.
Westminster City Council said restoring the system safely is a “complex process” and expects it will take “several weeks” to return to full business as usual, according to an update on their website .
Which services have been affected by the cyber attack?
Westminster City Council said most council services are running but some may experience delays. It said it is prioritising critical services, especially for vulnerable residents, but did not disclose what those services are.
Hammersmith and Fulham Council said teams are working around the clock with experts to review systems and restore them to business as usual. It said the following services are experiencing issues:
- Birth, marriage, civil partnership and death certificates – The council is currently unable to process certificate applications registered before 2006. If you need to order a certificate dated prior to 2006, please use the General Register Office service on GOV.UK
- My Account – MyAccount and most online forms are unavailable. This includes but isn’t limited to council tax accounts; benefits accounts; Housing Online (Bid for a home and Rents Online accounts); business rates; housing repairs form, parking bay suspension application, some report it forms
- Payments – You will still be able to make payments online and on the telephone, but you may not see the most up-to-date balance information on your accounts
- Parking Fines (PCNs) – PCNs may not be available to pay online
- Parking permits – Most online parking permit systems are operating as normal. If you’re having issues applying for a new resident or business visitor permit to allow access for a visitor via one of the council’s traffic schemes, please call the contact centre with the relevant vehicle details and the council can provide access
- Phone Lines: Phone lines are operating as normal but will be very busy while staff manage the extra calls due to the disruption to online services
- Property Licensing – The property licensing application form is currently unavailable
It has urged residents to keep updated via its Services and IT Update webpage.
Kensington and Chelsea Council said a number of systems have been impacted, including phone lines. The council said its website is also experiencing issues while the LDRS noticed it cannot access meeting agendas.
The council shares the responsibility of Adult Social Care and Children’s Services with Westminster City Council which is said to be operating “as usual,” according to an internal Westminster City memo seen by the LDRS last week.
The memo also said Westminster CIty’s Emergency Duty Team for out-of-hour support is also operating. It is understood the councils triggered “business continuity arrangements” and an emergency response. It is also understood that executive directors and senior managers are providing advice and support to affected service areas.
The LDRS also recently heard from one London resident who said he reported an issue with his heating late Tuesday afternoon but no one attended until Wednesday evening. The resident, who did not name the council, said it turned out the case had not made it over to the engineers. CAME FROM A JOURNO REQUEST ON SOCIALS.
Which services do the councils share?
According to a Kensington and Chelsea Council webpage last updated on August 11, 2025, the council operates several “shared services” with Westminster City. Those are:
- Adult Social Care
- Public Health
- Children’s Services
It also has “tri-borough arrangements” – that is, between itself, Westminster City and Hammersmith and Fulham – which are:
- Hospital discharge
- Audit
- Risk
- Fraud and insurance
- Fostering and adoption
- Pensions and Treasure
It’s not clear if any of these services have been impacted by the cyber attack.
What should I do if I need help?
Kensington and Chelsea Council said its customer services centre is open and additional staff will be at hand to help. It said some phone lines are up and running and urged anyone calling to understand that staff do not have all the answers at this point in time.
The council also ran a Customer Service Centre at Kensington Town Hall last weekend (November 29-30) from 10am to 4pm for emergency in-person queries. The council stressed staff are still unable to access many of its systems.
For enquiries, people are being told to visit the council’s Contact Us webpage for phone numbers and email contacts.
Westminster City said it is taking “swift and effective action” to bring all its systems back online as soon as possible and is urging anyone needing to report an immediate emergency issue to call 020 7641 6000 for the general line or 0800 358 3783 for Housing. If you need to make a children’s referral, call 0207 641 4000 or visit the children’s social care page . For adult social care call: 020 7641 2500.
When was the cyber attack and what happened?
All three councils were the target of a cyber attack on Monday, November 24, 2025. Kensington and Chelsea Council and Westminster City Council first identified the attack that day.
The two councils share a number of IT services and systems as part of a joint arrangement.
Last week, an NCSC spokesperson said the body was aware of an incident affecting some local authority services in London and is working to understand any potential impact.
A Met Police spokesperson said it received a referral from Action Fraud on Monday, 24 November, following reports of a suspected cyber-attack against borough councils in London. It said enquiries remain in the early stages within the Met’s Cyber Crime Unit and that no arrests had been made.
The LDRS and MyLondon became aware of the attack after being handed an internal memo by Westminster City Council. Staff at Hackney Council were also sent an urgent communication on Tuesday morning (November 25), warning them against phishing and social engineering attack methods, though the East London council is understood not to have been hit itself.
The Local Democracy Reporting Service (LDRS) revealed how Kensington and Chelsea Council arranged for some staff to work from home as a precautionary measure following last Monday’s attack. A memo, seen by the LDRS, asked staff “to remain vigilant and report any unusual or suspicious online activity to Tech Hub immediately”.
Meanwhile, a security expert told MyLondon the councils targeted in a cyber attack have probably experienced a “far more serious” incident than they are currently letting on.
Graeme Stewart, director of public sector at Check Point Software, told MyLondon: “The telling bit in this is the Information Commissioner’s Office (ICO). That’s your clue when you look at a cyber attack that it’s more serious… No one is going to basically contact the ICO unless it’s serious and it involves section 108. So the inference you can make is there has been some kind of data loss.”
Have you been affected by this? If so, contact Adrian at [email protected] or Callum at [email protected]
? Sign up to our daily newsletters for all the latest and greatest from across London here
