A cyberattack on 25 November 2025 affected the Royal Borough of Kensington and Chelsea, Westminster City Council and Hammersmith and Fulham Council simultaneously, disrupting telephone systems, online forms and multiple digital services used by residents.
Three Authorities Failing Together Implies Shared Infrastructure
These are separate legal entities with separate elected members, budgets and statutory duties. Their systems failed on the same day.
UK local authorities routinely share IT services to reduce cost — a shared services arrangement is a well-established response to constrained funding. It is the same trade the corpus filed at 25-0603b for managed service providers: the arrangement is the correct answer to a genuine funding problem, and it manufactures a single point of reach.
This desk does not assert the specific mechanism here, which is not established in the material we reviewed. Three authorities disrupted in one event is the observation.
And It Is The Second Multi-Agency Public-Sector File Of The Year
Sixty Nevada state agencies at 25-0824. Several Puerto Rico agencies through a shared contractor at 25-1126. Twenty South Korean asset managers through one provider at 25-1110b.
The pattern is consistent: public bodies consolidate IT because they cannot each afford it, and the consolidation converts one compromise into a portfolio. The corpus recorded at 25-0918 that a county cannot raise revenue the way a company can; shared services are what that constraint produces.
The Residents Have No Alternative
This desk filed at 25-1126 that a resident who needs a permit, a licence or a benefit payment has one place to obtain it, and at 25-0819 that municipal estates hold the most sensitive records under the thinnest supervision.
Three boroughs at once means several hundred thousand residents with no council to fall back on.
Compiled from public reporting, listed below. The intrusion route and any shared-infrastructure mechanism are not established. Corrections: corrections@forensicpost.com.