Three-week IT outage ‘did not compromise customer data’ councils confirm

Questions have been asked about a council IT outage which lasted more than three weeks.

Members of Adur and Worthing Councils’ Joint Governance Committee heard how the councils suffered an IT outage between March 6 and 31.

Mazars accountants said the outage had taken place following an annual audit which is carried out to make sure the councils can function properly and manage risks.

The most recent audit had ‘no assurance’ in the councils’ ability to recover IT systems, adding that this leaves them ‘open to significant error or abuse’.

Both councils have access to residents’ data for council tax and benefits purposes but a spokesperson confirmed that no personal data had been compromised during the recent outage.

“The outage was the result of a system failure in our data centre in the Town Hall,” the spokesperson said, “It was not the result of a cyber attack.”
Data is currently in the process of being moved away from the Town Hall to a ‘cloud’ solution.
This means it can be held remotely and accessed via the internet – something the council hopes will reduce risks.

“The hardware that failed was due to be replaced as part of the current Network Replacement Project to reduce the risk of an incident like
this occurring,” said the council spokesperson.

“This work is being completed at full speed and is due to finish in October 2022.”

But during Tuesday’s JGC meeting, councillors sought assurance that the systems are safe.

Rita Garner (Lab, Tarring) wanted to know when a final report on IT recovery would be ready and if it would include set deadlines.

Andy Whight (Lab, Marine) said: “We’re preparing for something that could happen any minute and that is quite urgent.”

In answer to this, Dave Phillips, a senior manager at Mazars, said a draft report had been circulated and would hopefully come to the next JGC meeting.

Steve Waight (Con, Goring) said systems recovery had been ‘raised before’. “You believed action had been taken to remove this as a significant risk,” he said.

“If so, how concerned are you now that you find that action wasn’t taken?”

The council’s chief financial officer, Sarah Gobey, said the issue had been raised before because the councils lacked a ‘disaster recovery plan’ – something that is now in place.

But Mr Waight said the outage was evidence that the plan ‘clearly didn’t work’.

Council IT systems had since evolved which may be why ‘new weaknesses’ are found, according to Ms Gobey.

“Obviously it’s a key matter of concern for both the council and the public that IT arrangements remain robust,” she said. Mr Phillips said cyber security had become ‘more and more of a real risk’ over the last five years with ‘more reliance on IT’.

Several councils have faced cyber attacks in recent years including Wealden District Council.