Council Online Services Down: How to Get Help

When a council is hit by a cyber attack, its website, online forms and payment systems can disappear overnight, and they do not always come back quickly. Real cases in the UK have shown that a serious attack can disrupt council services for months, with some service areas taking years to fully restore. If you rely on your council for housing, benefits, council tax or planning, it is worth knowing what an outage can mean and what you can do about it.

What this means for you is practical: the council's website being down does not mean the council has stopped. Phone lines, council offices and emergency teams usually keep working even when the systems behind them do not. This page explains what tends to stop, why, how long it can last, and how to get help with benefits, payments, housing, planning and urgent safety issues while the online systems are offline. For the wider picture of what a cyber attack means for your household, see our guide to cyber attacks and major IT failures.

Why council servers go dark: ransomware

Most major council outages in the UK have been ransomware attacks. In a ransomware attack, the files on an organisation's servers are encrypted, so the organisation cannot access its own devices or the data stored on them⁵. Cybercriminals encrypt systems or data and demand payment to restore access⁶. The National Cyber Security Centre (NCSC) explains the effect plainly: "In a ransomware attack, you won't be able to access your device or the data stored on it because the files are encrypted"⁵.

For a council, that is not just one broken computer. When Gloucester City Council was hit by a targeted ransomware attack in December 2021, the encryption of its servers "temporarily prevented the council from providing services which relied on the data held on those servers"⁷. Almost everything a modern council does, from assessing benefit claims to processing planning applications, relies on data held on those servers, so almost everything stops at once.

Ransomware has been identified by UK authorities as the number one cyber threat to the nation⁸, and the Joint Committee on the National Security Strategy heard that ransomware can cause severe disruption to the delivery of core Government services, including healthcare and child protection⁸. The Local Government Association told the same inquiry that ransomware risks to local authorities are still increasing, identifying it as the number one cyber security risk to councils¹. Ransomware attacks can have a significant impact on victims due to financial, data and service losses, which can lead to business closure, inaccessible public services and compromised customer data⁹.

One recurring cause is unpatched software. A North Yorkshire risk register notes that in NHS organisations affected by ransomware, many had not applied the recommended software updates in a timely manner, which left systems vulnerable¹⁰. Councils run large estates of ageing systems, and the parliamentary inquiry heard that operational technology systems are much more likely to include components that are 20 to 30 years old or use older, unsupported software¹. That is why an attack on one council can take services offline for months rather than hours. If you want to understand this threat in more depth, see our page on ransomware and how it affects households.

Which council services stop when systems go offline

The honest answer is: most of the ones you use through a screen. When Carmarthenshire County Council's online services were hit by a technical issue, people were unable to access My Account or make online reports or payments, and the systems the Customer Services team use were themselves affected². That is the pattern to expect: the website, online forms, payment pages, reporting tools and even the screens council staff work from can all be unavailable at once.

Essex's preparedness guidance sets out the wider stakes: critical services like local government websites or emergency response systems could be rendered temporarily unusable, and essential public services including emergency response, transportation and utilities could be interrupted⁶. The same guidance notes that local authorities and businesses are encouraged to have contingency plans for cyber incidents⁶, which is why councils usually find ways to keep the most urgent functions going.

What tends to keep working, or to come back first:

• Phone lines, even when the systems behind them are slow or paper-based
• Council offices and one-stop shops, where staff can take details by hand
• Emergency and safety teams, such as those dealing with dangerous structures or fallen trees
• Social media and service-status pages, which councils use to publish updates when the main website is down

One thing to watch for is that the outage can grow. Carmarthenshire warned that "There is a potential that, over the coming days, other online services will be taken down as a precautionary measure"¹¹. When a council discovers an attack, it often deliberately switches off more of its own systems to stop the infection spreading, so a website that worked on Monday may be gone on Tuesday. Do not assume a service that is still up will stay up; use it, or note the phone number, while you can.

Three real council attacks: what actually happened

The best guide to what a council outage looks like is what has already happened in the UK. Three attacks, at Redcar and Cleveland, Gloucester and Hackney, show the range: from a week of chaos to years of rebuilding.

Redcar and Cleveland: offline for almost a week

Redcar and Cleveland Borough Council fell victim to a ransomware attack on its server estate in February 2020, which kept it offline for almost a week and caused severe data loss¹. The council lost all systems, and its recovery took eight and a half months¹. The council refused to pay the ransom, in part to protect other local authorities from similar attacks¹. For residents, this is the shape of a worst case: nearly a week with essentially no council IT, followed by many months of partial, slow services while systems are rebuilt.

Gloucester: delays to benefits, property sales and planning

Gloucester City Council was the subject of a targeted ransomware attack in December 2021, which encrypted its servers⁷. The council has faced costs of around £800,000 after its systems were infected by malware from a Russian threat actor, and the attack caused delays to benefits payments, property sales and planning applications¹. The Local Government Association has published a case study of the attack, covering a timeline of the attack, its impact, the recovery process, the cost of the incident and the lessons learnt, based on the first hand experiences of key staff at the council, so that other councils can learn from their experience⁷. For residents, Gloucester shows the everyday face of a council attack: not a blank website so much as a chain of stalled transactions, from a housing benefit claim to a house sale waiting on a local search.

Hackney: housing services still not rebuilt months later

Hackney Council is the clearest lesson in patience. After a major cyber attack, one whole service area was still not fully restored a long time afterwards: as of August this year, it still hadn't rebuilt its systems for housing services¹. If your council is attacked and you rely on council housing or housing repairs, plan for a long disruption and build a paper trail of every contact you make.

How long a council outage can last

There is no single answer, but the real cases give honest bounds. At the short end, Redcar and Cleveland was offline for almost a week before basic services returned¹. At the long end, recovery of every service can stretch far beyond that, with some councils taking many months or longer to rebuild systems fully. A reasonable expectation for a serious ransomware attack is weeks to months of disruption, with urgent services patched up first and transactional services, like planning and benefits processing, taking longer.

It helps to compare this with other infrastructure outages, because councils plan against the same kinds of timescales. Surrey's risk guidance notes that loss of utility services can last a few minutes or much longer⁴, and East Cambridgeshire's guidance says loss of service can last for a few hours, days or weeks depending on the severity of the incident¹². The London Risk Register plans for scenarios such as a water supply failure affecting up to 350,000 people for between 24 hours and two weeks¹³. A cyber attack on a council sits at the long end of that spectrum, because the failure is not a broken pipe but encrypted data that has to be restored, verified and rebuilt.

The NHS experience bears this out: after a major ransomware cyber-attack on a pathology provider, services were fully restored by December 2024, but getting there took time. If a health service with national support takes months to return to normal, a single council should be expected to take at least as long for its less critical functions. See also our page on when banks, shops and public services go offline.

Data loss and what it means for your records

The Redcar and Cleveland attack caused severe data loss¹, and Hackney's attack locked the council out of key data and services including benefit and council tax payment information¹. When a council loses data, it can affect you in two ways: the council may lose records it holds about you, and criminals may have copied data about you before encrypting it.

Data breaches, unauthorised access to sensitive data stored by organisations including councils, hospitals and businesses, are a recognised risk in their own right⁶. If your details are taken in a breach, the practical risks are scam messages that quote real information about you, and attempts at identity fraud. Our pages on what to do if your details are in a data breach and how to spot scam messages after a data breach cover this step by step.

What you can usefully do now, before any attack affects your council:

• Keep your own paper or offline copies of anything important: tenancy agreements, benefit award letters, council tax bills, planning references. Our guide to keeping key records offline explains what to hold.
• Keep a list of emergency contact numbers for your utilities companies, as official emergency guidance recommends¹², and add your council's numbers to it.
• Note your reference numbers for benefits, council tax and housing, so you can prove what you are owed if the council's copy of the record is lost.

If the council's copy of your record is gone, you are not starting from nothing: you have statutory rights to the payments and services you qualify for, and the council must rebuild its records. Your own copies make that far easier.

Contacting the council when the website is down

When the website, online forms and My Account are unavailable², the phone becomes the main channel. Councils publish emergency and general contact numbers separately from their online services, and Carmarthenshire maintains a dedicated emergency contacts page for exactly this situation¹¹. Find and save your council's phone numbers now, before you need them, and note which office is nearest to you for in-person visits.

A few practical points drawn from how councils actually handle outages:

• Check service-status and social media channels. Argyll and Bute Council advises residents to check its service disruptions page and social media channels to find out about closures and problems¹⁴, and councils commonly use these channels when the main site is down.
• Expect phone queues. When online reporting is unavailable, everyone calls, so allow extra time and try early in the working day.
• Say if you are vulnerable. In the event of a utilities failure, local authorities are responsible for working with the company who brings the supply to your door and health services to identify and provide support to vulnerable people who are directly affected⁴. The same principle of identifying and supporting vulnerable residents applies when council services themselves fail, so state clearly if a delay leaves you without money, heating or medication.
• Keep a log. Note the date, time and name of everyone you speak to. With recovery taking months, you may need to prove what you were told and when.

For urgent safety issues, phone rather than use any form. Liverpool City Council is explicit about dangerous trees: "Do not contact us online to report dangerous trees as it will not notify the emergency teams and will delay inspection, which could result in serious harm"³. The same logic applies during an IT outage: online forms may be unmonitored, so anything dangerous needs a phone call.

Who is responsible when council services fail

The council is. Local authorities are category 1 responders under the UK's emergency planning arrangements, and community risk registers place county and unitary councils as lead agencies for failures affecting their area; Surrey's register, for example, lists Surrey County Council as the lead agency for social care provider failure and for failure of the national electricity transmission system¹⁵. In the event of a utilities failure, local authorities are responsible for working with the supply company and health services to identify and provide support to vulnerable people who are directly affected⁴.

Two limits are worth knowing. First, a council is not responsible for everything on its patch. Gloucester City Council states plainly: "We are not responsible for trees on private land"¹⁶, and adds that if you fail to act upon its advice, it may carry out the work on your behalf and recover the full costs from you¹⁶. Liverpool City Council handles dangerous or fallen trees on council-owned land, with emergency teams and a contractor carrying out assessment and work, and its property damage claims only apply to trees on council-owned land that have fallen into your property³. During an outage, work out first whose land the problem is on.

Second, a council is not automatically liable for everything that goes wrong while its systems are down. Devon County Council's position on icy roads illustrates the general principle: a claim would have to show loss or damage was caused as a result of negligence, and loss or damage due to situations beyond its control, such as severe weather, is not normally something the council can be held responsible for¹⁷. A cyber attack is similarly beyond the council's control in that sense; the council's duty is to respond, restore services and support affected residents, not to compensate for every consequence.

On the national side, the response is aimed at preventing the next attack rather than compensating victims of the last one. How the NHS, government and regulators respond to a major incident is covered in more detail on our how services respond page.

Preparing your household for a council outage

You cannot prevent an attack on your council, but you can remove most of the friction it causes your household. Household emergency preparation guidance covers loss of telephone or internet services as a scenario to prepare for¹⁸, and a council outage is a close cousin: the service still exists, but the digital door to it is shut.

What to have ready:

• A written list of council phone numbers: the main switchboard, housing, benefits, council tax and out-of-hours emergency line, written down before you need them
• Paper copies of your key documents: benefit award letters, tenancy or lease, council tax bill, planning references
• A record of your reference numbers, kept with the documents
• A way to pay without the council's website: direct debit, phone banking or paying at a bank or office, so a council tax or rent payment does not lapse because the payment page is down
• Basic household preparedness, as for any service disruption: our getting started and emergency kit pages cover the essentials

One more habit is worth forming: keep your own software updated. The North Yorkshire risk register's finding that many NHS organisations affected by ransomware had not applied recommended software updates in a timely manner¹⁰ applies to households too, since ransomware and the scams that follow it spread through the same carelessness. Our pages on software updates and protecting your accounts cover this in practical terms.

If money is the immediate problem, because a benefit payment is delayed or you cannot pay a bill, see our guide to paying for essentials when card machines and banking apps fail, and if the outage touches health services, our pages on NHS appointments during an IT outage and getting prescriptions when systems are down.