Oxford City Council

Oxford City Council experienced a cybersecurity incident resulting in the exposure of personal data of current and former Council officers over a 21-year period. The attackers accessed legacy systems containing personal details of individuals involved in Council-administered elections between 2001 and 2022. Although there is no evidence of mass data extraction or sharing with third parties, the incident caused significant disruption to local authority services for over a week. The Council has taken steps to minimize further impact and has reported the incident to relevant authorities.

Source: https://www.infosecurity-magazine.com/news/personal-data-oxford-council/

TPRM report: https://scoringcyber.rankiteo.com/company/oxford-city-council

"id": "oxf602062025",
"linkid": "oxford-city-council",
"type": "Breach",
"date": "6/2025",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'industry': 'Public Administration',
                        'location': 'Oxford, UK',
                        'name': 'Oxford City Council',
                        'type': 'Government'}],
 'data_breach': {'data_exfiltration': 'No evidence of mass download or '
                                      'extraction',
                 'type_of_data_compromised': 'Personal details'},
 'date_detected': '2025-06-07',
 'description': 'Oxford City Council disclosed a cybersecurity incident '
                'resulting in the exposure of personal data of current and '
                'former Council officers across a 21-year period.',
 'impact': {'data_compromised': 'Personal data of current and former Council '
                                'officers involved in elections between 2001 '
                                'and 2022',
            'downtime': 'Over a week',
            'operational_impact': 'Disruption to local authority services',
            'systems_affected': ['Legacy systems']},
 'investigation_status': 'Ongoing',
 'references': [{'source': 'Oxford City Council'}],
 'regulatory_compliance': {'regulatory_notifications': 'Reported to relevant '
                                                       'government '
                                                       'authorities'},
 'response': {'communication_strategy': 'Individually contacted people '
                                        'potentially affected',
              'containment_measures': 'Automated security systems removed the '
                                      'presence and minimized access',
              'incident_response_plan_activated': True,
              'law_enforcement_notified': True,
              'third_party_assistance': 'External cybersecurity experts'},
 'title': 'Oxford City Council Data Breach',
 'type': 'Data Breach'}