A cyberattack on Gloucester City Council’s IT systems could cost £1 million to fix, leaders have warned.
The December 2021 attack – which has been linked to Russian hackers – delayed benefit payments, planning applications and house sales.
The city authority had to rebuild all of its servers after malware infected its systems. The software was reportedly embedded in an email which had been sent to a council officer.
Officers have been working to restore services but costs keep rising, the Local Democracy Reporting Service said.
Following the attack, Gloucester City Council said its sources alleged the cyberattack was carried out by hackers from Russia. It also said it was working with the National Crime Agency and the National Cyber Security Centre to understand more about the attack.
Liberal Democrat group leader Jeremy Hilton asked councillors on September 29 how much it had cost so far to restore the IT systems and what the estimated final bill would be.
“Every time I ask the question about the costs of the cyberattack recovery, the cost rises more and more. It now stands at a whopping £787,000.
If you liked this content…
“Can you reassure members of the council that the final bill will not be more than £1m?”
Deputy leader of the council Hanna Norman (Cons) told the meeting she could not give that assurance.
Norman said all parties involved in the recovery were doing it in the most cost effective manner because they were spending Gloucester taxpayers’ money.
“I can give you the assurance that every penny we spend is scrutinised and we are making decisions based on value for money and what is right operationally for this authority and therefore Gloucester residents.”
She confirmed the council had spent £787,000 spent to date, of which £142,000 went on capital works.
As recently as August, property searches in Gloucester were still being hampered by the attack. Figures from Property Searches Direct reported a 174 day council turnaround (reliant on council staffing resources) and 80 regulated turnaround days (reliant on personal search agents), compared to searches in nearby Cheltenham, which take just 10 council days and nine regulated days.
In January 2022 the government said it was rolling out a new £37.8 million strategy to help combat cyber threats against UK public services.
