Kensington and Chelsea Says Historical Data Was Copied but Not Encrypted

The Royal Borough of Kensington and Chelsea disclosed that some historical data had been copied and exfiltrated from its systems, and that the data had not been encrypted or destroyed.

Data was copied. Data left. Data was not encrypted or destroyed. Each is separately checkable against the authority’s own systems, and together they describe an extortion-without-encryption incident rather than a ransomware event.

Compare that with the standard formulation this corpus records constantly: "certain information may have been accessed", followed by an offer of credit monitoring. This desk filed at 25-0908b that a field list and a clear instruction is what a useful notification looks like; this is the operational equivalent.

It means services can be restored from live systems rather than rebuilt — the distinction that made Nevada’s 28-day outage a rebuild at 25-0922, and Saint Paul’s recovery run for months at 25-1106.

It also means the extortion leverage is publication alone, which is the model this desk traced at 25-1204 and 25-0713: better encryption prevention does not reduce attacker revenue, it changes what the attacker sells.

The word suggests older records rather than current casework. That may be reassuring or it may be the opposite — the corpus filed at 25-1025 and 26-0414 that retained estates are enormous and the defensible core is narrow.

A council’s historical data includes former residents, closed housing and social services cases, and people who have moved away and have no reason to be watching for a notification. The corpus recorded that population problem at 25-1105 for declined applicants and 25-1028 for alumni.