"Criminals unfortunately only know too well that cyber-attacks can cripple systems and with many councils increasingly servicing local people’s needs digitally, they simply cannot afford to experience downtime."
- Johnty Mongan, Gallagher head of cyber risk management
Gallagher’s FOI request revealed that 2.3m attempted cyber-attacks against councils in the UK have been detected already this year. This figure was contributed to by 161 local authorities which Gallagher has noted as definitive that the size of the problem is likely to be significantly greater.
The actual number of attacks across all councils has been estimated to be greater than 11m in 2022.
The greatest cyber threat to councils was phishing attacks with 75% of councils stating this was the most common type of attempted attack. Distributed denial-of-service (DDoS) attacks represented the second most common cyber threat, ranking as the top threat this year for 6% of councils.
Gallagher has highlighted that while most incidents are intercepted by the IT security put in place by local authorities, the surveyed councils had collectively paid out over £10m over the past five years due to cybercrime – including monies lost to hackers, legal costs, and fines.
Furthermore, in a press release, Gallagher claimed that in response to the increase in cybercrime, only 52% of councils have received advice from an external expert on how to mitigate the risk of cyber attacks in the last 12 months.
Likewise, although 85% of councils have increased their cybersecurity, only 23% currently hold a cyber insurance policy.
Commenting on these figures, Johnty Mongan, Gallagher head of cyber risk management, has said:
“It is positive to see that councils are recognising this threat, and looking to employ external experts to help prevent cyber-attacks – risk management and putting in the right security is absolutely key, and external experts are best placed to advise what the most [up-to-date] measures are.”
Tim Devine, Gallagher managing director for government, housing, education & public sector agreed that it’s important for councils to have a plan in place should the worst happen. Devine noted that “with so many attacks happening every day, it only takes one error to cause significant problems.”
“The risk in terms of associated costs and reputational damage as a result of cyber threats means having specialist cyber insurance in place should be a key consideration but is by no means the only consideration for those wishing to mitigate the risks of an attack,” Devine added.
