Desk live·
ForensicPost
Breaches/Public sector/File 25-1125b

Three London Boroughs at Once

A cyberattack on 25 November 2025 struck Kensington and Chelsea, Westminster and Hammersmith and Fulham together, disrupting telephone systems, online forms and digital services.

Constructed geometry · not a chart of case data
JurisdictionUnited Kingdomthe affected organisation’s jurisdiction, not the actor’s suspected origin
TargetThree London boroughs
ActorUnattributed
D. Kennedy12 min readConfidence: high2 sources reviewed

A cyberattack on 25 November 2025 affected the Royal Borough of Kensington and Chelsea, Westminster City Council and Hammersmith and Fulham Council simultaneously, disrupting telephone systems, online forms and multiple digital services used by residents.

Three Authorities Failing Together Implies Shared Infrastructure

These are separate legal entities with separate elected members, budgets and statutory duties. Their systems failed on the same day.

UK local authorities routinely share IT services to reduce cost — a shared services arrangement is a well-established response to constrained funding. It is the same trade the corpus filed at 25-0603b for managed service providers: the arrangement is the correct answer to a genuine funding problem, and it manufactures a single point of reach.

This desk does not assert the specific mechanism here, which is not established in the material we reviewed. Three authorities disrupted in one event is the observation.

And It Is The Second Multi-Agency Public-Sector File Of The Year

Sixty Nevada state agencies at 25-0824. Several Puerto Rico agencies through a shared contractor at 25-1126. Twenty South Korean asset managers through one provider at 25-1110b.

The pattern is consistent: public bodies consolidate IT because they cannot each afford it, and the consolidation converts one compromise into a portfolio. The corpus recorded at 25-0918 that a county cannot raise revenue the way a company can; shared services are what that constraint produces.

The Residents Have No Alternative

This desk filed at 25-1126 that a resident who needs a permit, a licence or a benefit payment has one place to obtain it, and at 25-0819 that municipal estates hold the most sensitive records under the thinnest supervision.

Three boroughs at once means several hundred thousand residents with no council to fall back on.

How we reported this

Compiled from public reporting, listed below. The intrusion route and any shared-infrastructure mechanism are not established. Corrections: corrections@forensicpost.com.

Sources
  1. NCC supporting London councils gripped by cyber attacksComputer Weekly
  2. A wake up call for UK councils: inside the cyber attack that shut down London servicesSysGroup
D. Kennedy
Identity and access reporter. Former DFIR consultant. Signal on request.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary