Oxford City Council Hit By Cyber Attack: 21 Years of Election Worker Data Compromised

Over the weekend of 7-8 June 2025, Oxford City Council was hit by a cyber attack targeting its legacy IT systems. The breach exposed personal data, such as names and contact details, of individuals involved in council-administered elections between 2001 and 2022. These mainly consisted of current or former council officers, including polling station staff and ballot counters.

No evidence has been found that the compromised data was shared externally or downloaded in bulk.

Impact on the Council

The most immediate concern for Oxford City Council is reputational damage. There is an especially high level of expectation that public authorities safeguard personal data, especially when it comes to something as sensitive as elections. This incident involves over two decades of personal data, which will to some extent erode trust in the council’s ability to safeguard personal data effectively.

Financial repercussions are also possible. In addition to the cost of incident response, such as hiring cybersecurity consultants and implementing remediation measures, if an investigation from the Information Commissioner’s Office (ICO) finds that the council failed to meet its obligations under legal requirements, it could face enforcement action. In severe and high-profile cases, this can lead to fines of up to £17.5 million or 4% of annual turnover, whichever is higher.

Operationally, the breach caused significant disruption, with some services having to be taken offline temporarily while systems were reviewed and secured.

How Did Oxford City Council Respond?

The Council responded by taking a few immediate steps:

Quick detection and containment: Automated security systems quickly flagged the attack, which severed the attacker’s access, greatly reducing potential damage.

Engagement with industry experts: External cybersecurity experts were quickly bought in to conduct thorough investigations.

System lockdown and review: Impacted systems were taken offline and reviewed, despite the potential impact on users.

Breach notification: Affected individuals were quickly contacted, with support offered. Additionally, the incident has been reported to the ICO and law enforcement.

What Are the Key Takeaways From This?

The investigation into the incident is ongoing, but that doesn’t mean that there aren’t some key things we can learn from this incident:

Legacy systems can leave you vulnerable: Legacy systems are older and often have much weaker security measures compared to newer systems, which are frequently updated to guard against modern threats. While it’s easier and cheaper in the short-term to just retain these systems and delay upgrades until failure, you should upgrade to reduce the risk of being hit by an attack, which will probably cost you more than upgrading would have.

Automated systems can help prevent breaches: In this instance, the main reason why the cyber attack on Oxford City Council was able to be contained so quickly was due to detection from an automated system. This demonstrates the importance of having systems that can quickly detect breaches, which likely would have resulted in greater impact if the attacker was able to keep access for longer.

Good data retention practices are key: One of the standout parts of this incident that differentiates itself from other recent attacks is that some of the that the data compromised goes as far back as 2001, over 20 years ago. In line with the data minimization principle, in most cases, businesses typically have no reason to retain data this old as this, and therefore shouldn’t. Only keeping the data you need also reduces the potential impact of breaches, reducing the volume of data that could be compromised.

Engage with experts early: Consulting external data protection consultants (like PRIVACY HELPER) or cybersecurity experts reduces the risk that things are missed during the investigation. These experts can help identify vulnerabilities with your current procedures and implement the necessary changes. Their guidance can be vital in situations like this.

Downtime is sometimes unavoidable: While temporarily taking services offline may be inconvenient, it can be a necessary step in helping prevent further damage.

Next Steps

Ensuring that you handle, process and store personal data in a way that’s in line with the law isn’t easy. To be confident that you’re compliant, and to address any concerns you may have, contact PRIVACY HELPER today, and let us remove the stress of managing data compliance in your business.

Follow us on LinkedIn