Hackers publish Hackney Council data online after 2020 attack
The suspected ransomware incident in October last year knocked a number of council services offline


Data stolen from Hackney Borough Council in a major cyber attack last October has been published online by the hackers responsible.
Cyber security experts working with the local authority have confirmed “a limited set of data” has now been published online, four months after hackers infiltrated its networks.
The truth about ransomware The scariest security horror stories of 2020 Ransomware gangs pretend to delete stolen data to extort victims twice, report warns
The council has said the data, the nature of which hasn’t been disclosed, wasn’t published on any widely available public forums and is not visible through conventional search engines.
This means the data has likely been published on the dark web; a common practice by some groups following a ransomware attack either as proof of an attack, or if a ransom is demanded but not paid.
“It is utterly deplorable that organised criminals chose last year to deliberately attack Hackney, damaging services and stealing from our borough, our staff, and our residents in this way, and all while we were in the middle of responding to a global pandemic,” said the major of Hackney, Philip Glanville.
“Now four months on, at the start of a new year and as we are all responding to the second wave, they have decided to compound that attack and now release stolen data. Working with our partners we will do everything we can to help bring them to justice.”
The attack on council services in October last year led to outages lasting several weeks. The payment portal for paying rent and service charge, for example, was still unavailable a month after the incident.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
Glanville added the council is in contact with residents and staff about any risk to their personal data, and are working with its cyber security partners to assess the data and take action. The council has also been working with the National Cyber Security Centre (NCSC), National Crime Agency (NCA), and Information Commissioner’s Office (ICO).
Although the data hasn’t been fully examined, Hackney Borough Council is confident the vast majority of sensitive or personal information it holds hasn’t been affected.
The council hasn’t confirmed this was specifically a ransomware attack, although a handful of prominent cyber crime outfits have been known to publish their victims’ data on their own online platforms after an attack, which is accessible through the dark web.
DopplePaymer, for instance, published a sample of archive files online last year after hacking into a digital transformation company that boasts clients such as NASA and the Defense Information Systems Agency (DISA).
The tactic has also been commonly deployed by the Maze and Sodinokibi groups in the past as a blackmailing technique. The threat of publishing stolen material could potentially expose organisations to bad press, fines, and action by data regulators.
IT Pro asked Hackney Borough Council what internal measures it has taken following the incident in October, and whether it can confirm the attack involved ransomware.

Keumars Afifi-Sabet is a writer and editor that specialises in public sector, cyber security, and cloud computing. He first joined ITPro as a staff writer in April 2018 and eventually became its Features Editor. Although a regular contributor to other tech sites in the past, these days you will find Keumars on LiveScience, where he runs its Technology section.
-
OpenAI is teaming up with Nscale and Aker to build Europe's first AI gigafactory
News Stargate Norway aims to have 100,000 Nvidia processors up and running by the end of next year
-
Nearly half of enterprises aren't prepared for quantum cybersecurity threats
News Most businesses haven't even started transitioning to post-quantum cryptography, research shows
-
The Scattered Spider ransomware group is infiltrating Slack and Microsoft Teams to target vulnerable employees
News The group is using new ransomware variants and new social engineering techniques - including sneaking into corporate teleconferences
-
Hackers breached a 158 year old company by guessing an employee password – experts say it’s a ‘pertinent reminder’ of the devastating impact of cyber crime
News A Panorama documentary exposed hackers' techniques and talked to the teams trying to tackle them
-
The ransomware boom shows no signs of letting up – and these groups are causing the most chaos
News Thousands of ransomware cases have already been posted on the dark web this year
-
Everything we know about the Ingram Micro cyber attack so far
News A cyber attack on Ingram Micro severely disrupted operations and has been claimed by the SafePay ransomware group.
-
A prolific ransomware group says it’s shutting down and giving out free decryption keys to victims – but cyber experts warn it's not exactly a 'gesture of goodwill'
News The Hunters International ransomware group is rebranding and switching tactics
-
Swiss government data published following supply chain attack – here’s what we know about the culprits
News Radix, a non-profit organization in the health promotion sector, supplies a number of federal offices, whose data has apparently been accessed.
-
Ransomware victims are getting better at haggling with hackers
News While nearly half of companies paid a ransom to get their data back last year, victims are taking an increasingly hard line with hackers to strike fair deals.
-
LockBit data dump reveals a treasure trove of intel on the notorious hacker group
News An analysis of May's SQL database dump shows how much LockBit was really making