‘Cyber attack’ may have been ‘blessing in disguise’ as incident’s cost is revealed
In what could be seen as an example of good practice, one of Gloucestershire's biggest employers has revealed its efforts to deal with a 'cyber attack' that never happened cost it nearly £290,000.
*The Raikes Journal is the only independent news outlet in Gloucestershire approved to use the copy of the BBC local government reporting service. Why? Only only independent, credible journalistically-led platforms that meet the BBC’s high standards win that permission.
The false alarm cyber attack which affected Tewkesbury Borough Council may have been a “blessing in disguise” as the incident’s total bill is revealed.
The Gloucestershire local authority shut down all of the services it provides online on September 4 after they identified an issue within their IT systems.
A major incident was declared and council chiefs initially thought they had been “hit by hostile actors”.
They redeployed staff to towns and large villages across the borough to ensure the most vulnerable have access to the services they rely on.
Council leaders said at the time they did not know the full extent of the cyber security incident.
However, cyber specialists later assured them their systems are safe and have confirmed no data was lost as a result of the incident.
It is understood the incident was a case of the authority’s “own systems testing its own security”.
The council fully recovered from the episode by September 30. And the total costs incurred during the cyber incident total £289,625.28.
The council bought many laptops as a result of the issue and almost £30,000 was spent on cyber security equipment, mileage and provisions.
A total of £89,632 was spent on cyber contractors, £84,825.35 on planning contractors to deal with the backlog and £6,646 on environmental health to deal with a backlog.
Some £25,000 has also been spent in the current financial year on planning as a result of the incident.
More than £45,000 was spent on overtime and almost £2,000 on equipment, mileage and provisions.
It also cost the council £4,000 to reschedule training and more than £1,000 was spent on postage.
Councillors were told at a meeting this week that the authority is better prepared as a result of the incident.
Councillor Mike Sztymiak (I, Tewkesbury North and Twyning) presented a report which outlined the lessons learned from the cyber incident at the meeting on February 24.
He said the action to shut down the IT systems was taken to protect the borough’s most vulnerable residents as well as sensitive data.
“The council’s response has been recognised nationally for its proactive communications and transparency leadership and collaboration.
“While the incident did significantly impact our services, swift work arounds and strong partner support ensured continuity for critical functions.”
He thanked the staff for the “magnificent way” they responded to the cyber incident and said improvements have been implemented to enhance the council’s resilience.
“It came out of the blue, they rolled up their sleeves, they got out of their comfort zones and they got on with the job,” he said.
The incident may have been a blessing in disguise for the authority.
Councillor Cate Cody (G, Tewkesbury South) said: “We will never ever know but there is the other side of it,” she said.
“The lessons learned and some of the really good practice we now have because of this may have saved us a huge amount of money in the future.”
And Councillor David Gray (C, Winchcombe) said the authority has to remain vigilant and not rest on its laurels.
“What doesn’t kill you makes you stronger,” he said.
“We believe we have stress tested a lot of the arrangements we had in place and we are in a better position for the future. It’s a bit like wargaming.
“Every so often you should undergo an exercise and wargame how it would work in practical terms. The speed with which council officers reacted seems to have been exemplary. But I think it’s something we shouldn’t rest on our laurels.
“We need to keep that level of vigilance always before and think about how we make sure we are match fit for the next one. Because there will be a next one.”
By Carmelo Garcia, local democracy reporter for Gloucestershire. carmelo.garcia@reachplc.com