by Bill Heaney
West Dunbartonshire Council has been put on special alert about the immediate and ongoing impacts of a significant cyber-attack on Comhairle nan Eilean Siar.
The 2023 cyber-attack caused immediate, severe and prolonged disruption, with the impact most significant for the council’s finance team. It caused the near total loss of use of the data held on its servers.
In its report, the Accounts Commission recognises the council took swift action to protect systems and prioritise front-line services and payments to staff and suppliers.
But the council’s business continuity plans hadn’t fully anticipated the scale of the attack. Nor had action been taken to address previous weaknesses in IT and cyber governance.
Had the council been better prepared, it is possible that the attack’s impact might have been reduced.
Staff continue to work hard to maintain service performance; however, two years on, some services are still recovering and dealing with backlogs. The council must urgently carry out thorough and routine testing of its new response, recovery and business continuity plans.
Jo Armstrong, pictured, Chair of the Accounts Commission, said: ‘This cyber-attack shows how exposed local government is, and the urgent need to test resilience and recovery arrangements. Councils need to assume that it’s a case of when, not if, they are attacked. A collective approach is needed to prepare councils for an increasingly digital future – they must collaborate, learn from each other and work closely with partners, including the Scottish Government.
‘Comhairle nan Eilean Siar staff went above and beyond to mitigate the impacts on service users, suppliers and the local community. This increased pressure on staff as they took on additional work, alongside dealing with day-to-day responsibilities. We want the council to take action to improve how they communicate and support staff during significant events that could increase workload and stress.’