Stolen staff passwords are circulating for a third of UK councils

Why this matters

A council is the organisation a resident cannot choose not to deal with. Council tax, housing, school places, benefits, parking and social care all leave personal information with an authority the resident has no realistic option to take elsewhere. A message that appears to come from a council also carries the weight of an institution with legal powers, so it gets acted on quickly.

Yet councils sit outside the main UK cyber security regulations, with no dedicated regulator. What exists is a self-assessment framework rather than a duty.

Most published figures on this come from surveys, such as the government’s Cyber Security Breaches Survey, or from audit work carried out inside government, such as the National Audit Office’s. Both rely on what organisations report about themselves. This study asked nobody anything. Every number is an observation taken from outside with the same checks on every website: what a sector is showing to the world, rather than what it believes about itself.

What needs attention

Staff passwords in criminal collections: 122 of 379 councils, 506 records. About four records on a typical affected council — wide, not deep. These are keys to the council’s own systems, and the council can take them back today.

Three councils run software with a weakness criminals are known to be using now, listed in the public catalogue of weaknesses being exploited in the real world rather than merely recorded somewhere. Two are the same browser-side flaw in an old version of a widely used website library, on provider addresses in England and Northern Ireland; the third is on an address registered to the council itself, on web server software past the end of its supported life. All three were matched from version numbers and may already be patched.

16 councils have a fault on their own systems that any visitor or mail system would meet. 14 of them advertise a policy that protects their incoming email but serve it in a way no mail system can read, mostly because of a certificate problem, so the protection they have set up does not operate. Each fault is a configuration change.

12 councils have a service answering the internet that probably should not be, such as remote access, file transfer or an admin tool, on addresses not shared with unrelated organisations. 10 of them are on a database port, and the 10 sit inside the 12. Only 4 have a service actually identified, 3 of them databases; for the rest, the first question is whether anything is listening.

A further 4 cases sit on addresses shared with unrelated organisations, with no service identified. They are reported separately because no council can close them alone; a weakness there reaches every organisation on the platform.

27 councils do not force visitors onto a secure connection, so anything typed into those pages can be read or altered on the way. The earlier edition’s higher figure counted websites that refused our scanner’s plain request as failing; they are now counted as unknown, so the two figures should not be compared.

These rows overlap and must not be added together. 165 councils, 44%, carry at least one serious item, most of them because of staff passwords. Every item needs checking privately before it is treated as fact.

What is going well

Not one ransomware listing, breach record or browser-safety warning anywhere in 379 scans.

227 councils, 60%, tell other mail systems to refuse email forged in their name, and only 17 have not started. All 379 publish the record identifying their own mail servers. Councils have largely done this with no law requiring it.

Only three exact scores fall in the lowest band, and all three are in England.

Scores

All 379 websites completed a scan. 291 produced an exact score, averaging 76.3. Counting a further 62 floor scores at their floor gives 74.1 across 353 — the most cautious figure available. Use 76.3 for the sector’s measured position and 74.1 for the cautious one.

Some council websites answer an automated visitor with a protection page rather than the real homepage, usually a security control working. Where that was the only gap, the score is a floor: the true figure can only be the same or higher. 26 websites have no score: 15 because of a fault on the council’s own systems, 5 whose email policy server did not answer our scanner, and 6 whose website did not answer at all. Their findings still count in every figure on this page.

What this is not

It is not a claim that any council has been broken into: we could not see inside one and did not try. It is not an audit, a penetration test or a compliance judgement. It is not a league table, and it does not rank the four nations. No council is named.

Privacy

243 of the 308 homepages we could read showed no cookie consent mechanism. That is a reason to open the site in a browser and watch, not a finding: there are innocent explanations, and the regulator tests exactly the behaviour an outside scan cannot see.

Separately, 46,948 records across 359 websites belong to residents’ own accounts on council services, from residents’ own infected devices. Nobody at the council can reset those; only the resident can.

Where to start

1. Deal with the three actively exploited weaknesses this week. Confirm the running version before anything else, and go to the council privately first; the two on provider addresses need the provider brought in.
2. Fix the 16 faults on councils’ own systems. Serve the email policy they already advertise with a valid certificate, or withdraw it until it can be served, and send the full certificate chain or correct the redirect on the other two.
3. Check the 12 exposed services, 10 of them on a database port. Confirm who owns each address. Where nothing was identified on the flagged port, the first question is whether anything is listening.
4. Reset the staff passwords — reset, end active sessions and confirm multi-factor sign-in. Never test a recovered password.
5. Force every visitor onto a secure connection on the 27 councils that do not, and test for compatibility before switching it on.
6. Finish the forged-email work, carefully. The 17 councils whose email policy is missing or monitoring-only should list every legitimate sender and watch before enforcing, never jumping straight to refusal.

The 4 shared-provider cases are a question for the provider, and are reported separately because no council can close them alone.