Glasgow City Council cyber incident still not resolved

Glasgow Times

3 days ago

Early in the morning of Thursday, June 19, the council's ICT supplier CGI discovered malicious activity on servers managed by a third-party supplier.
The local authority said an investigation into the incident was continuing, alongside Police Scotland, the Scottish Cyber Coordination Centre (SC3) and the National Cyber Security Centre.
They are still unable to say whether residents' data has been stolen, but have contacted the Information Commissioner's Office (ICO) on the presumption that it has.
No council financial systems have been affected in the attack, they said, and they were able to say that no details of bank accounts or credit/debit cards processed by those systems have been compromised.
The affected systems include the council's planning portal, making online access to planning applications is unavailable. They are unable to take online payments for penalty charge notices, and drivers are also unable to submit online appeals. And citizens are unable to book revenue and benefits callback appointments online.
READ MORE: Warning as data at risk as Glasgow City Council hit by cyber attack
The cyber attack, and work to secure the council's systems in the wake of it, have also left people unable to access birth, death and marriage certificates; comments and complaints; FOI requests; planning enforcement; public procession applications; the Glasgow Film Office location library; the council's bin collection calendar; taxi complaint forms; the diary of council meetings; and forms to organise commercial bulk uplifts.
Security specialists reviewing the incident have confirmed that it was not caused by email, and the council has urged residents to be particularly cautious about any contact claiming to be from them.
Residents have also been targeted by scam messaging asking recipients to pay outstanding parking fines online.
At this stage, the council can't totally discount that this scam involves stolen data but they are confident that it doesn't, with early indications suggesting it is far more likely to be the work of either opportunistic criminals, trying to exploit the disruption to normal online services, or a more widespread scam.
The local authority has been reassuring customers that it doesn't use text messages to chase payment of parking fines and parking penalties can be paid by calling the number displayed on the PCN.
READ MORE: Send us photos of your June newborn to appear in Glasgow Times
A spokesman for the council said: 'We are aware of what appear to be scam text messages, directing recipients to pay outstanding parking fines online.
'The suspicious messages do not mention Glasgow, or any other location – however, we do know they have been received by at least some people in the city and elsewhere in the city region.
'The city council is currently being impacted by a cyber security incident, which has forced us to take some of our digital and online customer services offline – including the payment of parking penalties.
'We are investigating as a matter of urgency and details of the suspicious messages have been shared with police and national cyber security teams that are assisting us.
'We will never call, email or message you asking for banking details – and, if you do need to pay a parking penalty, you can do so by calling the number displayed on the PCN.'
The council urges those contacted by someone claiming to have their data to contact Police Scotland on 101.