Cardiff's children's chief confirms data leak 2 months after cyber risk was 'escalated'
(2025/03/28)
- Reference: 1743164894
- News link: https://www.theregister.co.uk/2025/03/28/cardiff_childrens_chief_says_city/
- Source link:
Cardiff City Council's director of children's services says data was leaked or stolen from the organization, although she did not clarify how or what was pilfered.
Deborah Driffield confirmed a "data breach" while giving an update to the council's Governance and Audit Committee, which assembled on Tuesday.
"We have had a data breach that we are currently managing, and drawing up new arrangements in relation to this world of people stealing data and sharing it on the dark web, and trying to understand how we can mitigate against that.
[1]
"That's a fairly new area for us but we have shared the risks there and certainly are working with Welsh government, Data Cymru, and all the other local authorities on that."
[2]
[3]
Driffield mentioned the incident while adding that cybersecurity was one of the five "elevated" corporate risks the council was facing when it came to children's services. A council [4]document [PDF] said cybersecurity risks were particularly a problem when the department had to work with "third parties."
Aside from confirming the existence of the "breach," the children's chief didn't offer much in the way of additional details.
[5]
However, a data exposure at a children's services department could implicate a broad range of sensitive information. The department is primarily tasked with safeguarding children. Its main duties include ensuring young people stay in families, providing disability support, reducing offending rates, and ensuring fewer young people have to be cared for by social services over time.
Equally, the "breach" could concern only staff data, or benign administrative documents – the possibilities are myriad.
The Register contacted the council, requesting more information about when the "breach" was discovered, how much data was involved, whether any data was stolen, what kind of data was compromised, and whether the affected individuals have been notified.
[6]
We also asked the council and Data Cymru if the incident is related to the latter's [7]November ransomware attack . Data Cymru is a company that works only for and is elected by Welsh local governments to help inform data-driven public service delivery, and [8]wider reports suggested it may have been the source of the breach.
Neither the council nor Data Cymru immediately responded to requests for input. Socura, the "delivery partner" for CymruSOC (Wales' National Security Operations Centre), told us: "Socura does not comment on security incidents affecting other organisations."
Driffield alluded to ongoing work at the council to improve its cybersecurity risk rating which is currently in the very highest tiers, although the target is to reduce it to the upper-medium tier by the end of the year.
[9]US defense contractor cops to sloppy security, settles after infosec lead blows whistle
[10]Healthcare outfit that served military personnel settles allegations it faked infosec compliance for $11M
[11]Trump 'waved a white flag to Chinese hackers' as Homeland Security axed cyber advisory boards
[12]Chinese ship casts shadow over Baltic subsea cable snipfest
Current and planned action to be carried out before the end of the year includes rolling out improved security products across the authority, completing general training for all staff, carrying out [13]phishing exercises , putting all senior management through a cyber breach workshop, and procuring better security and governance tools, according to a [14]council document [PDF]. A number of other initiatives remain ongoing.
Cardiff's risk rating for cybersecurity was raised in January 2025, and another [15]document [PDF] shared with the council's Governance and Audit Committee noted that any failures in this area could present "a potential safeguarding risk to children."
It also indicated the council was still working on an action plan to reduce this escalated risk, but aimed to have it implemented by the end of the year 2025/26. ®
Get our [16]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Z-bVty1ahy0B1-QYMoO3IwAAA0Y&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z-bVty1ahy0B1-QYMoO3IwAAA0Y&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z-bVty1ahy0B1-QYMoO3IwAAA0Y&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://cardiff.moderngov.co.uk/documents/s84418/Item%205%20-%20Cover%20Report.pdf?LLL=0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z-bVty1ahy0B1-QYMoO3IwAAA0Y&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z-bVty1ahy0B1-QYMoO3IwAAA0Y&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.data.cymru/data-cymru-has-been-the-victim-of-a-cybersecurity-incident
[8] https://www.bbc.co.uk/news/articles/cp8l6xx6r84o
[9] https://www.theregister.com/2025/03/26/us_defense_contractor/
[10] https://www.theregister.com/2025/02/19/decadeold_healthcare_security_snafu_settled/
[11] https://www.theregister.com/2025/01/22/dhs_axes_cyber_advisory_boards/
[12] https://www.theregister.com/2024/11/21/chinese_ship_baltic_cable/
[13] https://www.theregister.com/2024/05/23/google_phishing_tests/
[14] https://cardiff.moderngov.co.uk/documents/s84446/Item%209.1%20-%20Appendix%20A.pdf?LLL=0
[15] https://cardiff.moderngov.co.uk/documents/s84421/Item%205%20-%20Appendix%20C.pdf?LLL=0
[16] https://whitepapers.theregister.com/
Deborah Driffield confirmed a "data breach" while giving an update to the council's Governance and Audit Committee, which assembled on Tuesday.
"We have had a data breach that we are currently managing, and drawing up new arrangements in relation to this world of people stealing data and sharing it on the dark web, and trying to understand how we can mitigate against that.
[1]
"That's a fairly new area for us but we have shared the risks there and certainly are working with Welsh government, Data Cymru, and all the other local authorities on that."
[2]
[3]
Driffield mentioned the incident while adding that cybersecurity was one of the five "elevated" corporate risks the council was facing when it came to children's services. A council [4]document [PDF] said cybersecurity risks were particularly a problem when the department had to work with "third parties."
Aside from confirming the existence of the "breach," the children's chief didn't offer much in the way of additional details.
[5]
However, a data exposure at a children's services department could implicate a broad range of sensitive information. The department is primarily tasked with safeguarding children. Its main duties include ensuring young people stay in families, providing disability support, reducing offending rates, and ensuring fewer young people have to be cared for by social services over time.
Equally, the "breach" could concern only staff data, or benign administrative documents – the possibilities are myriad.
The Register contacted the council, requesting more information about when the "breach" was discovered, how much data was involved, whether any data was stolen, what kind of data was compromised, and whether the affected individuals have been notified.
[6]
We also asked the council and Data Cymru if the incident is related to the latter's [7]November ransomware attack . Data Cymru is a company that works only for and is elected by Welsh local governments to help inform data-driven public service delivery, and [8]wider reports suggested it may have been the source of the breach.
Neither the council nor Data Cymru immediately responded to requests for input. Socura, the "delivery partner" for CymruSOC (Wales' National Security Operations Centre), told us: "Socura does not comment on security incidents affecting other organisations."
Driffield alluded to ongoing work at the council to improve its cybersecurity risk rating which is currently in the very highest tiers, although the target is to reduce it to the upper-medium tier by the end of the year.
[9]US defense contractor cops to sloppy security, settles after infosec lead blows whistle
[10]Healthcare outfit that served military personnel settles allegations it faked infosec compliance for $11M
[11]Trump 'waved a white flag to Chinese hackers' as Homeland Security axed cyber advisory boards
[12]Chinese ship casts shadow over Baltic subsea cable snipfest
Current and planned action to be carried out before the end of the year includes rolling out improved security products across the authority, completing general training for all staff, carrying out [13]phishing exercises , putting all senior management through a cyber breach workshop, and procuring better security and governance tools, according to a [14]council document [PDF]. A number of other initiatives remain ongoing.
Cardiff's risk rating for cybersecurity was raised in January 2025, and another [15]document [PDF] shared with the council's Governance and Audit Committee noted that any failures in this area could present "a potential safeguarding risk to children."
It also indicated the council was still working on an action plan to reduce this escalated risk, but aimed to have it implemented by the end of the year 2025/26. ®
Get our [16]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Z-bVty1ahy0B1-QYMoO3IwAAA0Y&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z-bVty1ahy0B1-QYMoO3IwAAA0Y&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z-bVty1ahy0B1-QYMoO3IwAAA0Y&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://cardiff.moderngov.co.uk/documents/s84418/Item%205%20-%20Cover%20Report.pdf?LLL=0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z-bVty1ahy0B1-QYMoO3IwAAA0Y&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z-bVty1ahy0B1-QYMoO3IwAAA0Y&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.data.cymru/data-cymru-has-been-the-victim-of-a-cybersecurity-incident
[8] https://www.bbc.co.uk/news/articles/cp8l6xx6r84o
[9] https://www.theregister.com/2025/03/26/us_defense_contractor/
[10] https://www.theregister.com/2025/02/19/decadeold_healthcare_security_snafu_settled/
[11] https://www.theregister.com/2025/01/22/dhs_axes_cyber_advisory_boards/
[12] https://www.theregister.com/2024/11/21/chinese_ship_baltic_cable/
[13] https://www.theregister.com/2024/05/23/google_phishing_tests/
[14] https://cardiff.moderngov.co.uk/documents/s84446/Item%209.1%20-%20Appendix%20A.pdf?LLL=0
[15] https://cardiff.moderngov.co.uk/documents/s84421/Item%205%20-%20Appendix%20C.pdf?LLL=0
[16] https://whitepapers.theregister.com/
Unaccepatble
It is bad enough that "private" companies do not tell the truth about cybersecurity incidents.
Unforgivable when it is the council or other part of UK state apparatus - we citizens have no alternative to having to interact with various aspects of state governance, if they expose our confidential data then
a) those affected must be told exactly what data has been exposed
b) without exposing sensitive personal data that was "stolen" to the general public, as much detail as possible should be provided to the public and be on their guard (as it is quite possible more data was stolen than the council believe was stolen)
c) Full disclosure of why there were flaws - given that councillors are elected by the public then relevant to future voting intentions to know e.g. this was due to cuts / lack of funding from national level or from local level then [people may want to vote out people / parties to blame. Conversely, if it is just incompetence then public still need to know e.g. if some "high up" in the council was phished then that is a major issue (given their potential access to a lot of sensitive data then such people need to be extremely careful with cyber hygiene) - conversely if a "nobody" was phished but system security poor so sensitive data could be exfiltrated then speaks of issues with IT setup.