Hackney Council data breach

In 2020, Hackney Council suffered a data breach exposing sensitive information relating to vulnerable individuals. This included the names and addresses of women and children living in local hostels for their protection, details of vulnerable tenants and contact information for council estate residents who had requested repairs.

The breach was caused by the privacy settings on the online project management tool Trello being mistakenly set to public. The issue was only discovered when investigators from the local newspaper Hackney Citizen brought it to the council’s attention.

This incident followed a serious cyber-attack just months earlier, which disrupted essential online services for several weeks and resulted in stolen data being published on the dark web. In response to that attack, Hackney mayor Philip Glanville pledged to strengthen the council’s security measures. However, despite these assurances, further documents were leaked due to human error.

What data was revealed in the Hackney Council data breach?

This careless mistake meant that sensitive documents, such as an unredacted spreadsheet containing the names and addresses of women placed in temporary accommodation for their safety, became available to anyone with access to the internet. This was not only a privacy error but could also put them in serious physical danger.

Weeks later, a second upload published contact details for council tenants who had requested repairs for boilers, door buzzers and broken doors. Other instances involved a screenshot of a vulnerable tenant’s address and NI number, notes from a frail resident’s welfare check and minutes from a housing meeting revealing the council was losing a significant amount of money caused by the cyber-attack.

Links were repeatedly posted to a public Google doc that covered which flats are likely to be empty during the school run period. All of which were made possible by manually setting workspaces to public, despite a post for inducting new employees specifically warning users to be careful when using Trello and Google docs. It stated: “If you don’t take steps to protect work-related information while using such tools, it could put people and services at risk.”