Scottish councils are being urged to learn from the immediate and ongoing impacts of the significant cyber-attack on Comhairle nan Eilean Siar, which took place in 2023.

The attack caused immediate, severe, and prolonged disruption, with the impact most significant for the council’s finance team. It caused the near total loss of use of the data held on its servers.

The November 2023 cyber-attack saw the Western Isles council’s website go down as its IT system was severely disrupted. The Council got in touch with Police Scotland to aid them in their investigation. The cyber-attack was estimated to cost the council potentially half a million pounds to recover from.

The Accounts Commission of Audit Scotland, upon its review of the cyber-attack, recognised that the council took swift action to protect systems and prioritise front-line services and payments to staff and suppliers.

However, it says that the council’s business continuity plans had not fully anticipated the scale of the attack, and action had not been taken to address previous weaknesses in IT and cyber governance.

Audit Scotland claims that if the council had been better prepared, it is possible that the attack’s impact may have been reduced.

Recommended reading

• DIGIT Expo 2025 | Inside the West Lothian Council Ransomware Attack
• Western Isle Cyber-attack May Cost £500K for Full Recovery
• Breaking: Suspected Ransomware Attack Western Isles Council Causes IT Disruption

“This cyber-attack shows how exposed local government is, and the urgent need to test resilience and recovery arrangements,” Jo Armstrong, chair of the Accounts Commission, said.

“Councils need to assume that it’s a case of when, not if, they are attacked. A collective approach is needed to prepare councils for an increasingly digital future – they must collaborate, learn from each other and work closely with partners, including the Scottish Government.

“Comhairle nan Eilean Siar staff went above and beyond to mitigate the impacts on service users, suppliers and the local community.

“This increased pressure on staff as they took on additional work, alongside dealing with day-to-day responsibilities. We want the council to take action to improve how they communicate and support staff during significant events that could increase workload and stress.”