Connect with us

Business & Technology

Council data breaches rise 53% in five years, study finds

Published

on


Recorded data breaches across 78 of England’s largest local councils rose 53% over five years, according to research by password management company Passpack. Referrals to the Information Commissioner’s Office (ICO) for the most serious incidents increased 41% over the same period.

The study drew on Freedom of Information responses from 78 of 100 councils contacted, covering 2021 to 2025. In the most recent reporting year supplied by each authority, the councils logged 16,902 incidents on internal breach registers and made 305 referrals to the ICO.

The figures cover a wide range of incidents, from emails sent to the wrong recipient to breaches serious enough to require notification to the regulator. Under UK GDPR, organisations must report a breach to the ICO within 72 hours if it is likely to pose a risk to individuals’ rights and freedoms.

Across the dataset, the ratio of internal incidents to ICO referrals was about 50 to one. This suggests most logged events were minor, but the rise in referrals points to an increase in incidents councils judged serious enough to have potential consequences for residents.

Largest rises

Among authorities with data for the full period, Wiltshire Council recorded the sharpest increase in internally logged incidents, up 601% from 341 in 2021 to 2,391 in 2025. Gateshead Council followed with a 302% increase, while the London Borough of Greenwich rose 215% and Salford City Council 191%.

Wiltshire also recorded the highest total number of incidents in the latest year covered, ahead of Bristol City Council with 721, Wakefield Council with 607, Sheffield City Council with 574 and Manchester City Council with 533.

Bristol recorded the highest number of ICO referrals in its latest reporting year, with 21. Cumberland Council and Cornwall Council each recorded 16, followed by Shropshire Council with 15 and the London Borough of Enfield with 14.

Council responses

Several councils said the figures reflected stronger internal reporting rather than a direct rise in damaging breaches or cyber attacks. Some also stressed the distinction between data-handling incidents and cyber security events.

A Manchester City Council spokesperson said the FOI data covered all types of potential data incidents, including near misses, cases where no data was lost and incidents flagged by other organisations that may have affected the council.

They said such incidents would not necessarily qualify as data breaches, and many did not involve personal data breaches. Many were low-level data-handling issues and did not involve unauthorised system access, malware or external threat actors, but were still reported internally as good practice.

The spokesperson added that annual mandatory GDPR training had improved staff understanding of good data practice and reporting responsibilities. Greater awareness, clearer reporting routes and better detection mechanisms meant issues that might previously have gone unreported were now being logged and managed appropriately.

Manchester also said cyber security and data protection were treated as separate risk areas, and that combining the two would give a misleading impression of its cyber security position. It said there had been no material cyber security incidents affecting core systems or resulting in the loss of personal data, and that a higher number of reported data protection incidents reflected stronger organisational maturity and a more open reporting culture, rather than weaker cyber security controls.

Bristol, which recorded the most ICO referrals, said it encouraged staff to report all suspected incidents, however minor, so they could be investigated and used to improve controls.

Wakefield Council, one of the authorities with the highest internal incident totals, said the figures included minor, non-reportable events and that no cyber attacks had resulted in a personal data breach during the period covered.

Wiltshire Council said its high totals reflected a broad reporting culture that included near misses and incidents identified through data loss prevention tools introduced through Microsoft 365. It added that none of the breaches it had reported to the ICO over the past five years had resulted in enforcement action.

Broader pressure

The findings come as local government faces sustained scrutiny over cyber resilience and data protection practices. Councils hold large volumes of residents’ personal information, including housing, social care, education and benefits data, while many operate under financial pressure.

Several major incidents have affected councils in recent years. Leicester City Council suffered a ransomware attack that disrupted IT systems and phone lines for weeks, while an attack on housing software supplier Locata affected housing websites used by Manchester, Salford and Bolton councils. Following a 2020 ransomware attack, Hackney Council spent more than GBP £12 million in a single financial year on recovery.

The research also noted the lack of a consistent national approach to how local authorities detect, classify and record data incidents. That makes direct comparisons difficult, particularly when one authority logs near misses and another records only confirmed breaches.

The London Borough of Bexley said the increase in reported data breaches should be seen in the context of a more open and mature reporting culture. It said staff had been encouraged to report all actual and potential data breaches, however minor, so they could be investigated, lessons learned and controls improved.

Bexley added that while the overall number of internally reported breaches had increased, the number requiring notification to the ICO had remained broadly consistent. In its view, that suggests the rise was driven mainly by better internal reporting of lower-level incidents rather than an increase in serious breaches, and reflected greater awareness of the importance of data protection across the organisation.



Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Business & Technology

O2 joins Cellnex to boost Brighton Main Line coverage

Published

on



SOFIAH NICHOLE SALIVIO

News Editor

O2 has signed an agreement with Cellnex to join the Brighton Main Line connectivity project. The route serves more than 300,000 passengers on weekdays.

The deal gives O2 access to Cellnex infrastructure along the rail corridor between London, Gatwick Airport and the South Coast. It will support a phased rollout of mobile coverage, including 5G, across the full route in the coming months.

The Brighton Main Line is one of the UK’s busiest commuter railways, serving London Victoria, London Bridge and Clapham Junction. It carries 1,700 train movements a day and links services operated by Thameslink, Southern, Gatwick Express, Great Western Railway and London Overground.

Cellnex has been building the network under a 25-year contract awarded by Network Rail in 2021. The project uses a neutral host model, allowing mobile operators to use shared infrastructure rather than build separate systems along the line.

The shared network is intended to address long-standing gaps in mobile coverage on a route shaped by tunnels, deep cuttings and older station infrastructure. Once fully activated, the system is expected to provide high-speed connectivity across 99% of the 108km corridor.

O2 is the latest operator to join the programme after Three UK signed up in 2023. The addition of a second operator suggests Cellnex is gaining support for its model as rail passengers and regulators place greater scrutiny on mobile coverage and network resilience.

Station upgrades

Part of the work has focused on the main London stations served by the route. Indoor mobile systems are being installed at London Victoria, London Bridge and Clapham Junction, which together account for about 19% of rail passenger traffic to and from the capital from outside London.

The build includes 130km of fibre, four base station hotels to house operator equipment, 39 distributed antenna systems in tunnels and trackside areas, a dedicated station distributed antenna system at the three main stations, and 16 macro sites along the route. The three-year programme has so far required more than 129,000 working hours and more than 11,000 worker entries on the lineside and at stations.

For O2 passengers, the agreement means coverage improvements will be introduced in stages as parts of the system go live. The aim is to improve reliability for customers travelling between the coast and the capital.

Steve Cray outlined the case for the project.

Steve Cray, Managing Director, Cellnex UK, said: “Regular railway passengers will understand the frustration of losing signal mid-conversation or spending whole journeys with buffering videos. With O2 now on board, many more passengers are going to notice the difference on one of the UK’s most important commuter routes. This collaboration stands as one of the most significant end-to-end telecommunications infrastructure deployments on the British railway so far, and we are proud to be setting a new standard for the UK’s entire rail network.”

Operator demand

As a neutral host provider, Cellnex designs, plans and builds infrastructure that multiple mobile network operators can connect to. The approach can cut duplicate investment and reduce the amount of equipment needed across the railway estate.

For O2, the Brighton Main Line forms part of a broader effort to improve coverage where people travel and work. Rail corridors remain difficult mobile environments because of moving trains, variable terrain, and the engineering limits of older tunnels and stations.

Professor Robert Joyce, Director of Mobile Access Engineering, O2, said: “Our £700m Mobile Transformation Plan is focused on delivering reliable connectivity in the moments that matter most, and railway lines are a key part of that. By working with Cellnex to improve connectivity along the Brighton Main Line, we’ll be bringing improved coverage and capacity to customers travelling from the coast to the capital over the coming months.”

Network Rail, which is partnering with Cellnex on the scheme, said the line has been one of the most technically difficult parts of the railway for mobile coverage. The infrastructure has had to be installed while the route remained operational.

Paul Richmond, Head of Business Development, Network Rail, said: “Passengers on the Brighton Main Line deserve connectivity that matches the importance of this route, and our long-term partnership with Cellnex is transforming what has historically been one of the most technically demanding corridors for mobile coverage into a showcase for modern railway connectivity. A huge amount of collaboration has gone into this project over the last few years to support the infrastructure on a railway that is constantly operational. With O2 now on board, even more passengers will soon experience the benefits of this investment every time they travel.”



Source link

Continue Reading

Business & Technology

Grove and Wantage fun day boosts cash for community groups

Published

on


Money raised from the event will go towards helping local people in the OX12 area (Image: Ed Nix)

The free summer extravaganza, held on Saturday, June 13, was jointly organised by Grove Rugby Football Club, the Ray Collins Trust and Grove Scouts, with more than 40 stalls raising money for charities and community causes in Wantage and Grove.

Bands, soloists and choirs performed from midday (Image: Ed Nix)

From midday, bands, choirs and soloists performed as children tucked into a free picnic and parents enjoyed hot barbecue food served by Scouts.

READ MORE: Award-winning RHS Chelsea Flower Show designer from Oxfordshire gets MBE

A giant funfair offered classic attractions such as hook-a-duck, alongside bird of prey displays.

There was lots of dancing and singing at the fun day (Image: Ed Nix)

American Dance School led line dancing and showcases, with further demonstrations in rugby and martial arts.

Live music played from 12pm to 11pm (Image: Ed Nix)

Dog owners could also enter their pets into a show run by National Animal Welfare Trust Berkshire and sponsored by Larkmead Vets.





Source link

Continue Reading

Business & Technology

Akamai launches AI agent traffic security framework

Published

on


Akamai has introduced a security framework to manage AI agent traffic, aimed at businesses that need to verify whether automated requests should be allowed to act.

Built into its Bot & Agent Control products, the framework combines identity checks, traffic monitoring and enforcement at the network edge. It targets merchants, publishers and other organisations facing a rise in automated requests from AI agents acting on users’ behalf.

The launch reflects a broader industry focus on whether an AI agent can be tied to an authorised human user and whether its behaviour can be trusted. That question has become more urgent as agents begin to shop, retrieve content and carry out tasks previously completed directly by people in browsers or apps.

Akamai’s model is built around six areas: verified identity, user-linked authentication, trust analysis, edge enforcement, content monetisation and traffic visibility. It is working with several partners to connect those elements.

One part of the framework focuses on agent identity in commercial transactions. Akamai is working with Visa on the Trusted Agent Protocol and with Skyfire and Experian on the Know Your Agent framework, intended to let agents declare identity, origin and intent while linking them to the platforms they use and the users they represent.

The approach is designed to help businesses distinguish between a legitimate AI shopping assistant and a malicious bot that may appear similar when it first connects to a website. It also aims to provide an audit trail for transactions carried out by software acting for a person.

Visa said agent identity will be a basic requirement if automated commerce is to expand.

“Without trusted identity and explicit permissioning, AI agents cannot participate in commerce at scale,” said Rubail Birwadker, Senior Vice President, Head of Growth Products and Partnerships, Visa. “Visa’s Trusted Agent Protocol provides the identity layer that defines how agents are authenticated, authorized, and trusted at the transaction level so businesses and consumers can transact with confidence.”

Experian described the issue as one of transparency and accountability in AI-led interactions.

“AI agents are quickly becoming part of digital commerce, but trust will determine how far and how fast adoption grows,” said Kathleen Peters, Chief Innovation Officer at Experian. “With the Experian Agent Trust framework, we are helping businesses bring more transparency and accountability to AI-driven interactions by verifying identities, assessing risk, and strengthening confidence in every transaction. Our collaboration with Akamai and other ecosystem leaders reflects the industry’s shared commitment to building a secure foundation for agentic commerce that consumers and businesses can trust in real time.”

Skyfire, which is also involved in the identity effort, said commercial use of agents depends on a recognised trust layer.

“AI agents can’t participate in the economy without trusted identity and the ability to transact,” said Amir Sarhangi, Chief Executive Officer and Co-Founder, Skyfire. “Skyfire provides that foundation – enabling agents to authenticate, operate within policy, and access global payment rails. With Akamai, we’re bringing that trust layer to the edge, so enterprises can securely enable trusted agents without re-architecting their existing systems.”

Identity checks

Another element covers the hand-off between a human user and an AI agent. Integrations with identity providers including Auth0 and Ping Identity allow organisations to apply existing checks such as behavioural analysis and multi-factor authentication to the agents their customers use.

The idea is that a company should not rely only on a session or browser signal when an agent is involved. Instead, it should be able to assess who the agent represents, what it is permitted to do and whether its actions match the user’s established profile.

“AI agents introduce a new trust challenge because session-based trust alone is no longer sufficient. Organisations need to understand who they represent, what agents are allowed to do, and how their actions are governed in real time,” said Loren Russon, Vice President, Product Management, Ping Identity. “By combining Ping’s Runtime Identity capabilities with Akamai’s edge enforcement and visibility, enterprises can extend identity and access controls to AI-driven interactions with stronger accountability and oversight.”

Akamai said the framework also moves beyond a simple allow-or-block approach. Its trust analysis layer is intended to assess interactions across browsers, bots and agents on a spectrum, helping organisations decide which requests support commercial goals and which may signal fraud, abuse or operational risk.

Publisher model

For publishers and content owners, the system also addresses how AI agents access and pay for web content. Partnerships with TollBit and Skyfire support models in which access can be negotiated and charged on a pay-per-request basis.

That could give media groups and other content businesses a way to distinguish between ordinary visitors, beneficial agents and scraping activity, while also setting commercial terms for machine-driven access to material on their sites.

The framework is tied to Akamai’s traffic analysis tools, including TrafficPeak, which can provide a view of how human users, useful AI agents and malicious bots interact with websites over time. Security teams and business managers can then use that data to adjust access rules and revenue strategies.

At the infrastructure level, enforcement happens at the edge of Akamai’s distributed network, allowing decisions on incoming requests to be made quickly without shifting checks to a central system.

Patrick Sullivan, Vice President, Chief Technology Officer of Security Strategy, Akamai, said the goal is to give businesses a way to tie identity to decision-making as automated interactions increase.

“AI agents are replacing clicks, acting and handling commerce for us. For that to work, businesses need to recognize not just the agent, but who is behind it and what it’s trying to do,” said Sullivan. “We’ve built this so that identity informs visibility, visibility drives trust, and trust powers the decisions that let companies safely grow and monetize these new AI interactions. We’re giving businesses the confidence to open their doors to AI without compromising security.”



Source link

Continue Reading

Trending