Royal Borough of Kensington and Chelsea (representing the coordinated attack on Kensington and Chelsea, Westminster, and Hammersmith & Fulham councils)

A highly coordinated cyberattack disrupted three major London councils—Kensington and Chelsea, Westminster, and Hammersmith & Fulham—forcing a complete shutdown of IT networks and phone systems. The attack, targeting shared government infrastructure, crippled critical public services for over 400,000 residents, including housing support, social services, and waste collection during the peak holiday season. Authorities activated emergency protocols, prioritizing system protection and data containment while refusing to disclose specifics, though the attack vector has been identified. The incident mirrors global trends of cybercriminals exploiting under-resourced public sector entities. While ransomware is strongly suspected (given the immediate network isolation and historical patterns), officials remain silent on the exact nature. The attack’s sophistication and simultaneous multi-council impact suggest a deliberate campaign against London’s local government, risking prolonged service outages and potential data compromise across densely populated, high-profile boroughs.

Source: https://www.techbuzz.ai/articles/london-councils-hit-by-major-cyberattack-emergency-plans-activated

TPRM report: https://www.rankiteo.com/company/western-riverside-waste-authority

"id": "wes1032810112725",
"linkid": "western-riverside-waste-authority",
"type": "Cyber Attack",
"date": "11/2025",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of geographical region"

{'affected_entities': [{'customers_affected': '400,000+ (shared across three '
                                              'councils)',
                        'industry': 'Public Sector',
                        'location': 'London, UK',
                        'name': 'Royal Borough of Kensington and Chelsea',
                        'type': 'Local Government Council'},
                       {'customers_affected': '400,000+ (shared across three '
                                              'councils)',
                        'industry': 'Public Sector',
                        'location': 'London, UK',
                        'name': 'Westminster City Council',
                        'type': 'Local Government Council'},
                       {'customers_affected': '400,000+ (shared across three '
                                              'councils)',
                        'industry': 'Public Sector',
                        'location': 'London, UK',
                        'name': 'Hammersmith & Fulham Council',
                        'type': 'Local Government Council'}],
 'customer_advisories': 'Public advised of service disruptions; limited '
                        'details shared to avoid aiding attackers',
 'description': 'A sophisticated cyberattack has disrupted IT networks and '
                'phone systems across three London councils—Kensington and '
                'Chelsea, Westminster, and Hammersmith & Fulham—affecting over '
                '400,000 residents. The councils, which share IT '
                'infrastructure, activated emergency response protocols, '
                'shutting down systems to contain the threat. Essential public '
                'services, including housing support, social services, and '
                'waste collection, have been disrupted during the holiday '
                'season. The attack is believed to be targeted and '
                'coordinated, though specifics (e.g., ransomware involvement) '
                'remain undisclosed as UK law enforcement investigates.',
 'impact': {'brand_reputation_impact': 'High (affecting trust in local '
                                       'government during holiday season)',
            'operational_impact': 'Severe disruption to public services, '
                                  'including housing support, social services, '
                                  'and waste collection',
            'systems_affected': ['IT networks',
                                 'Phone systems',
                                 'Public service portals (housing support, '
                                 'social services, waste collection)']},
 'initial_access_broker': {'high_value_targets': ['Shared IT infrastructure of '
                                                  'London councils']},
 'investigation_status': 'Ongoing (UK law enforcement involved; attack vector '
                         'identified but not disclosed)',
 'response': {'communication_strategy': 'Limited public disclosure to avoid '
                                        'aiding attackers; confirmation of '
                                        'ongoing investigation with UK law '
                                        'enforcement',
              'containment_measures': ['Shutdown of IT networks',
                                       'Shutdown of phone systems',
                                       'Isolation of shared infrastructure'],
              'incident_response_plan_activated': True,
              'law_enforcement_notified': True,
              'recovery_measures': ['Protecting systems and data',
                                    'Restoring systems',
                                    'Maintaining critical public services']},
 'title': 'Coordinated Cyberattack on Three Major London Councils',
 'type': ['Cyberattack', 'Potential Ransomware']}