A CYBER attack on Comhairle nan Eilean Siar (Western Isles Council) showed “how exposed local government” is, according to a new report today.

The incident in November 2023 left vital systems such as financial records as well as back-ups becoming encrypted and inaccessible and the council with a £950,000 clean-up bill.

Looking into the circumstances of the incident, the Accounts Commission praised staff efforts to prioritise front-line services and payments to staff and suppliers, but warned councils another attack was inevitable. 

Calling for a collective approach to prepare for it, Accounts Commission chair Jo Armstrong said: “This cyber attack shows how exposed local government is, and the urgent need to test resilience and recovery arrangements.

“Councils need to assume that it’s a case of when, not if, they are attacked. 

“A collective approach is needed to prepare councils for an increasingly digital future — they must collaborate, learn from each other and work closely with partners, including the Scottish government.”

Welcoming the report, Comhairle nan Eilean Siar chief executive Malcolm Burr said: “The report illustrates the scale of the cyber attack’s impact and commends the excellent response of Comhairle nan Eilean Siar employees.

“The report rightly recognises the significant risk of cyber attacks. 

“To allow local authorities to improve cyber security resilience and disaster recovery preparedness it is important that funding for local authorities keeps pace with necessary measures to combat malicious technology and techniques.”

A Scottish government spokesperson said: “We welcome the Accounts Commission report and echo their advice.

“The Scottish government and its Scottish Cyber Co-ordination Centre work closely with all public bodies, including councils, to share intelligence and support incident response planning.”