Government to pay £3.6m towards council cyber attack
Last updated 8th Apr 2021
Redcar and Cleveland Council says it is being given £3.68m in Government financial support following a ransomware attack by hackers last year which crippled its computer network.
But the cash is well short of the £10.4m the local authority previously said the incident in February 2020 cost with one senior Labour figure describing it as a “joke”.
Council chiefs said the money was being offered in the form of a grant – not the facility to borrow more – due to the unique circumstances involved, which remain subject to a criminal investigation.
The council stressed its IT system had been “approved by Government” before the incident and had now been further improved with new firewalls and other security measures more advanced than those in place at other councils.
The cyber attack impacted right across all service areas and for a period shut down its website and left staff to rely on pen and paper.
Talks with civil servants in the Department for Communities and Local Government have dragged on for many months with the council being asked to provide evidence of the impact as part of a due diligence process before any money could be paid.
Last December Middlesbrough South and East Cleveland MP Simon Clarke said a payment was due to be paid in January and the matter has continued to be raised in council meetings with frustrated councillors demanding an end to the saga.
Council leader Mary Lanigan, who fronts an independent/Liberal Democrat coalition, confirmed it had covered the costs from its own reserves and the newly agreed grant would go some way towards replenishing those.
She said: “This offer from the Government is unprecedented and is the result of long and hard, but fair, negotiations with our colleagues in central Government and our team pushed very hard.
“We are pleased that the Government recognised the unique circumstances under which we requested support and awarded grant funding.
“They rightly distinguished the criminal ransomware attack suffered by the council from the financial rescue packages of some other local authorities where permission to borrow has been granted.”
She added: “These cyber criminals were not just causing damage to a council computer system, but were attacking all the people we provide services for, including some of our most vulnerable.
“We can be proud that none of our most important services were stopped and I would like to pay tribute to all those hard working teams in the council who worked so hard to keep our services going.
“No money was handed over to these criminals and we continue to hope that they will eventually be brought to justice.”
Cllr Lanigan’s predecessor, Labour’s Sue Jeffrey, said the cyber-attack had been an “IT disaster”.
She said: “Council tax payers and the leader of the council are being conned into thinking they have got a good deal when in fact they have only received a tiny proportion of the support they were promised by the Government and local Conservative MPs.
“This so-called ‘exceptional financial support’ is a joke and must be challenged.”
Councillor Carl Quartermain, leader of the Labour group on the council, said: “I have no idea why they the Government have dragged their heels on this over such a long course of time when they have been bandying about grant money here, there and everywhere during covid for various different things.
“The council did put in the costs of this a long time ago and you wonder how urgent it has been.”
Tory MP Mr Clarke said the funding was an “exceptionally generous” settlement and praised the support that had been received during discussions by the likes of Local Government Secretary Robert Jenrick and Luke Hall, the Minister for Regional Growth and Local Government.
He said: “This is a really important intervention by the Government to support Redcar and Cleveland Council, who have been the victims of a serious criminal act.
“£3.68 million of capital funding represents an exceptionally generous settlement and I am pleased to have worked hard alongside the council’s leadership and my colleague, Jacob Young MP, to help secure a fair outcome for our area that will allow the council to continue its important work for all our constituents.”
Redcar MP Mr Young said: “I want to add my thanks to the officers and staff at Redcar and Cleveland Council who worked night and day to tackle the fallout of this serious criminal attack on the local authority’s IT systems.
“This fair and generous settlement with the Government will go some way to restoring the hit on the council’s finances.
“I pay tribute to Cllr Lanigan and managing director John Sampson for their leadership in what has been an incredibly challenging year for the authority.”
Experts from the UK’s National Cyber Security Centre were drafted in to help restore the council’s computer network after the ransomware attack which knocked payment systems, online appointment bookings and planning documents offline, and scrambled files and data.
The council said the restored network now came with the addition of “enhanced monitoring and intelligence of activity and threat” and had been given a Government safety certificate.
The National Crime Agency has been conducting an investigation into the incident, but to date no individuals have been arrested or charged and it is thought those responsible may well be operating from overseas.
Cyber attack timeline
:: February 8, 2020 – Computer hackers render the council’s website and internal IT systems inoperative. Council leader Mary Lanigan reassures residents that no personal data was compromised. The council initially refuses to answer whether it has paid a ransom to the hackers
:: March 5, 2020 – Council’s website remains offline and only displays a holding page with some limited functionality – the full website is later restored
:: May 1, 2020 – 90% of IT systems have had data recovered, allowing frontline services to continue as normal, the council says.
:: June 16, 2020 – Cllr Lanigan says she will take a plea for cash help direct to ministers’ door as the need is “critical”
:: July 10, 2020 – Cllr Lanigan says she is hoping for a result very shortly so the authority can plan its finances with greater certainty and it has been engaged in “very frank” discussions with the Government
:: August 4, 2020 – Council confirms cost of cyber attack at more than £10m in a budget update with a report stating the Government has agreed to provide financial support
:: October 2, 2020 – External auditor Mazars says the council did have proper arrangements in place to prevent or reduce the likelihood of a cyber attack and they were “commensurate” given resources at its disposal. It also says efficient and effective steps were taken to recover systems following the incident
:: November 20, 2020 – Cyber attack is partly blamed for a 68% reduction in parking fines issued by council enforcement officers as handheld devices used to issue fines were put out of action
:: December 11, 2020 – MP Simon Clarke says he is confident that the Government will release a payment to the council in January. Cllr Jeffrey says it is unacceptable that the Government is yet to put its hand in its pocket
:: April 7, 2021 – It is confirmed the Government will make a £3.6m payment towards the cyber attack costs.