St Helens Council suspected cyber-attack caused significant disruption

A cyber attack against a council caused "significant" disruption when key systems were lost, a report has found.

St Helens Council was the victim of a suspected ransomware incident which was identified on 21 August.

It resulted in data being "stolen and exported to an external digital services and storage point, referred to as the cloud" between 17 and 21 August.

The report said many staff and teams were impacted, but systems were quickly restored with "workarounds in place".

The report, which the Local Democracy Reporting Service said would come before a cabinet meeting on Wednesday, also found the authority's technical response teams worked quickly to identify the source and contain the attack.

The incident was "successfully contained" by 21 August and a recovery plan put in place, according to the report.

It added: "Throughout the incident, the council liaised with multi agency stakeholders to manage the response and recovery including the Department for Levelling Up, Housing and Communities, the Information Commissioner's Office (ICO) and the Department for Work and Pensions (DWP).

"The data loss was reported to the ICO in line with expected timescales and further to internal investigation, the ICO have confirmed that they are satisfied with the outcome and will not be pursuing enforcement."

The report said: "However, the council remains in an extended period of recovery with a full post-incident action plan to ensure return to full business as usual.

"Lessons learned will be used to inform the next steps and future improvements to enhance security and limit the potential for similar attacks in future."

The cabinet is recommended to note the report and the proposed next steps to ensure the future security of the council's systems and associated data.

Why not follow BBC North West on Facebook, X and Instagram? You can also send story ideas to [email protected]