It is a Sunday morning mid-October 2020 when Rob Miller first heard there was a problem. The databases and IT systems at Hackney Council, in East London, have been shut down. At the time, the UK was entering a deadly second wave of the coronavirus pandemic, with millions living under lockdown restrictions and normal lives severely disrupted. But for Miller, the public agency’s chief strategy officer, things are about to get much worse. “At lunchtime, it was clear that it wasn’t just the technical stuff,” says Miller.
Two days later, leaders of Hackney Council – one of London’s 32 local governments and responsible for the lives of more than 250,000 people – revealed that it had been cyber attack. Criminal hackers have deployed ransomware that severely cripples its systems, limiting the council’s ability to take care of those who depend on it. The Pysa ransomware group later claimed responsibility for the attack and a few weeks later the statement published the data it stole from the council.
Today, more than two years later, Hackney Council is still dealing with the massive aftermath of a ransomware attack. For about a year, many council services were unavailable. Critical council systems—including housing and social care payments—are not functioning properly. While its services are now back up and running, parts of the council are still not functioning as they were before the attack.
A WIRED analysis of dozens of board meetings, minutes and documents reveals the scale of disruption ransomware caused to the board and, importantly, the thousands of people it serves. People’s health, housing situation and finances are affected by the attack of the insidious criminal group. The Hackney attack stands out not only because of its severity, but also because of the amount of time it took to organize recovery and help those in need.
Request a ransom
You can think of local governments as complex machines. They include thousands of people who run hundreds of services related to almost every area of a person’s life. Most of this work goes unnoticed until something goes wrong. For Hackney, the ransomware attack brought the machine to a halt.
Among the hundreds of services Hackney Council provides are child and social care, waste collection, welfare payments for those in need of financial assistance and public housing. Many of these services are operated using in-house engineering systems and services. In many ways, this can be seen as critical infrastructure, making Hackney Council unlike hospitals or energy providers.
Jamie MacColl, a cybersecurity and threat researcher at the RUSI consultancy, who is researching the social impact of ransomware, said: “The attacks are aimed at public sector organizations, like local council, school or university, quite powerful. “It’s not like the power grid is down or the water supply is disrupted… which are very important to everyday existence.”
Miller told councilors at a public meeting assessing the 2022 ransomware attack. All systems hosted on Hackney’s servers were affected. Social care, housing allowance, council tax, business rates and housing services are some of the most affected. Databases and records inaccessible — the board did not pay any ransom demands. “Most of the data and our IT systems that generate it are unavailable, which has really had a devastating impact on the services we can provide and the work we do. do,” Lisa Stidle, data and insights management at Hackney Council, said in a council recovery talk last year.
