Three London councils, one attack: the risk of shared services

On 24 November 2025 an attack on the shared IT systems of Kensington and Chelsea, Westminster and Hammersmith and Fulham led to data theft and services still down eight months later. The analysis: one infrastructure for several insureds, the public sector as a long-tail risk and questions for renewals.

Archive: reconstruction written in November 2026

Topic of the month, November 2025 · by cybercoverinsurance

On 24 November 2025 a cyber attack hit the shared IT systems of three London councils: Kensington and Chelsea, Westminster, and Hammersmith and Fulham. Phone lines, websites and online services failed, the councils invoked emergency plans, and on 1 December Kensington and Chelsea confirmed data theft. Some resident services were still down in July 2026.

For cyber underwriters the case is about shared services: a common infrastructure, chosen to save money, that ties several bodies to the same incident. The theme applies to the public sector, but also to corporate groups, consortia and business networks that share systems.

What is known

The attack. Kensington and Chelsea and Westminster share IT services under joint agreements, and Hammersmith and Fulham uses the same services. On 24 November the Metropolitan Police received a referral about a suspected attack. The councils invoked business continuity and emergency plans, prioritising the most vulnerable residents. The National Cyber Security Centre supported isolation and restoration of systems (The Register).

The data. On 1 December Kensington and Chelsea said it had evidence that some data had been taken, believed to be historical data, and warned that it could become public. It advised those who had bought services such as parking permits to check their cards and accounts. Westminster said full restoration would take several weeks. Hammersmith and Fulham isolated its network and said it had no evidence its own systems had been compromised. The National Crime Agency and the data protection authority were involved (Fitzrovia News).

The audit. In its annual report published in October 2026, auditor Grant Thornton identified a successful phishing attack as the cause and found significant governance weaknesses. Some resident services were still offline in July 2026. Disconnecting systems created backlogs and reduced income from residents' payments. The auditor recommended a costed, prioritised plan to upgrade systems, equal weight for prevention and response, and more anti-phishing training (Local Government Lawyer).

What is not known. The cost of the attack, whether there was insurance cover and the number of residents whose data was taken have not been made public. The perpetrator has not been publicly identified.

One infrastructure, three insureds

Savings create dependency. Shared services cut public bodies' IT costs. But an incident on a common infrastructure hits every body that uses it. For underwriters, three councils sharing IT are not three independent risks.

Isolating quickly reduces the loss. Hammersmith and Fulham isolated its network and found no evidence its own systems had been compromised (Fitzrovia News). The ability to cut off quickly from a shared infrastructure is the control that separates a body that is hit from one stopped as a precaution.

Who is the insured when the systems belong to everyone. With a shared service, the question of who runs the systems, who is liable and which policy pays has no obvious answer. Agreements between bodies should settle it before the incident, not after.

The public sector as a long-tail risk

Eight months to return to normal. Some services were still offline in July 2026 (Local Government Lawyer). For a local authority the loss is not only the technical cost, but backlogs, substitute services and lost income. A policy's typical indemnity period can be shorter than the real recovery.

Old systems, slow recovery. The auditor linked the length of recovery to the need to strengthen the council's IT estate (Local Government Lawyer). For underwriters, system obsolescence is an indicator of a claim's duration, as well as its likelihood.

Phishing is still the way in. The cause given is a successful phishing attack. The auditor's recommendations focus on training. For the questionnaire, the useful data is not whether training exists, but how frequent it is, how many complete it and whether there are simulations.

What to bring to renewals

Impact for insurersMedium

A successful phishing attack on a shared IT infrastructure hit three London councils, with data theft and services still down eight months later.

On the portfolio side, the case suggests treating bodies that share IT services as a single risk for aggregation purposes. The same applies to corporate groups and business networks with common systems: the number of insureds does not say how many distinct infrastructures there really are.