The Royal Borough of Kensington and Chelsea (RBKC), along with Westminster City Council (WCC) and the London Borough of Hammersmith and Fulham (LBHF), suffered a **cyberattack** leading to widespread service disruptions. The attack targeted shared IT infrastructure, crippling phone lines, online services, and contact centers, forcing the councils to activate emergency protocols. RBKC, serving 360,000 residents, confirmed the incident as a **cybersecurity issue** starting on Monday, with investigations ongoing to determine data compromise. Westminster City Council, a critical local authority overseeing landmarks like the Houses of Parliament and Buckingham Palace, also faced operational halts. A third council, LBHF (180,000 residents), preemptively isolated its networks, causing further business interruptions. The attack disrupted essential public services, including resident communications and administrative functions. While no ransomware group has claimed responsibility, security expert Kevin Beaumont identified it as a **ransomware attack** on a shared service provider. The UK’s National Cyber Security Centre (NCSC) and external cyber incident experts are assisting in recovery, but the full extent of data exposure remains unclear. The Information Commissioner’s Office (ICO) has been notified per regulatory requirements.
Royal Borough of Kensington and Chelsea cybersecurity rating report: https://www.rankiteo.com/company/royal-borough-of-kensington-and-chelsea
"id": "ROY5692156112625",
"linkid": "royal-borough-of-kensington-and-chelsea",
"type": "Ransomware",
"date": "11/2025",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of geographical region"{'affected_entities': [{'customers_affected': '360,000 residents',
'industry': 'Public Administration',
'location': 'London, UK',
'name': 'Royal Borough of Kensington and Chelsea '
'(RBKC)',
'size': 'Small (wealthiest in UK by GDP per capita)',
'type': 'Local Government'},
{'customers_affected': '360,000 residents (shared with '
'RBKC)',
'industry': 'Public Administration',
'location': 'London, UK',
'name': 'Westminster City Council (WCC)',
'size': 'Major local authority',
'type': 'Local Government'},
{'customers_affected': '180,000 residents',
'industry': 'Public Administration',
'location': 'London, UK',
'name': 'London Borough of Hammersmith and Fulham '
'(LBHF)',
'size': 'Mid-sized',
'type': 'Local Government'},
{'industry': 'Technology',
'name': 'Unnamed Services Provider (shared IT '
'infrastructure)',
'type': 'IT Service Provider'}],
'customer_advisories': ['Alternative phone numbers provided via website '
'banners'],
'date_detected': '2024-02-12T00:00:00Z',
'date_publicly_disclosed': '2024-02-13T00:00:00Z',
'description': 'The Royal Borough of Kensington and Chelsea (RBKC) and '
'Westminster City Council (WCC) announced service disruptions '
'due to a cybersecurity incident. A third council, the London '
'Borough of Hammersmith and Fulham (LBHF), also took '
'precautionary measures, leading to business disruptions. The '
'councils share IT infrastructure, and the attack impacted '
'multiple systems, including phone lines. Investigations are '
'ongoing, with no confirmed data compromise or ransomware '
'group claim yet. The UK Information Commissioner’s Office '
'(ICO) has been notified.',
'impact': {'brand_reputation_impact': ['Potential reputational damage due to '
'service disruptions'],
'operational_impact': ['Service disruptions',
'Activation of emergency plans',
'Business disruptions in LBHF due to '
'isolation measures'],
'systems_affected': ['Phone lines',
'Online services',
'Contact center',
'Computerised systems (shut down as '
'precaution)']},
'investigation_status': 'Ongoing (perpetrators and motives under '
'investigation; no confirmation of data compromise)',
'references': [{'source': 'BleepingComputer'},
{'source': 'Royal Borough of Kensington and Chelsea (RBKC) '
'Statement'},
{'source': 'Westminster City Council (WCC) Statement'},
{'source': 'London Borough of Hammersmith and Fulham (LBHF) '
'Statement'},
{'source': 'Security Expert Kevin Beaumont'}],
'regulatory_compliance': {'regulatory_notifications': ['UK Information '
'Commissioner’s Office '
'(ICO) notified']},
'response': {'communication_strategy': ['Public statements',
'Website banners with alternative '
'contact numbers',
'Updates to residents and partners'],
'containment_measures': ['Shut down of computerised systems',
'Isolation and safeguarding of networks '
'(LBHF)'],
'enhanced_monitoring': ['Enhanced measures to isolate and '
'safeguard networks (LBHF)'],
'incident_response_plan_activated': True,
'recovery_measures': ['Restoring systems',
'Maintaining critical services'],
'third_party_assistance': ['Specialist cyber incident experts',
'National Cyber Security Centre '
'(NCSC)']},
'stakeholder_advisories': ['Updates to residents and partners planned in '
'coming days'],
'title': 'Cybersecurity Incident Affecting Royal Borough of Kensington and '
'Chelsea, Westminster City Council, and London Borough of '
'Hammersmith and Fulham',
'type': ['Service Disruption', 'Potential Ransomware Attack']}