Glasgow City Council has said that the cybersecurity incident that was discovered back in June did not result in any loss of data.

Experts investigating the incident have said they are confident there is no evidence of data having been stolen or encrypted.

A report from specialist cybersecurity experts, received by the council, says they have ‘high confidence’ that the incident has been contained.

The attack last month had hit servers operated by a third-party supplier to one of the council’s ICT providers, CGI.

Work to safely recover online services is well advanced and will continue into August in some cases.

The cyber incident was discovered on 19 June when CGI discovered malicious activity on servers hosted by a third-party supplier.

Glasgow City Council said they acted quickly to isolate those servers in an effort to protect the council’s wider network. However, taking them offline unavoidably disrupted a number of their day-to-day digital and online services.

Following expert advice, the council took an early decision to proceed on the basis that data was likely to have been lost – and that this may have included customer data.

Subsequent independent forensic analysis has found no evidence of encryption or exfiltration of council or customer data – however, the Council will still closely monitor the situation.

Although there is evidence that attempts were made to download data, these were all denied.

The investigation characterises this as an opportunistic attack on a third-party supplier, rather than on the council itself. Access was gained through the supplier’s network, rather than via any council system or user.

Recommended reading

• Glasgow City Council Warns of Possible Data Theft Following ‘Cyber Incident’
• No Evidence So Far of Data Theft in Glasgow City Council Cyber-attack
• Report: Cyber Breaches Are Tanking Share Prices

Although the incident has disrupted council services, the loss of some web-based services was caused by the isolation of the affected servers, rather than the cyber incident itself.

Many of the highest priority services are now back online, with temporary workarounds in place for others.

A recovery plan is in place to restore each of the affected services, with all but a handful of applications, which are dependent on external support, expected back online by mid-August.

The council is sorry for the continued inconvenience this will cause customers.