Info Gov

The Royal Borough of Kensington and Chelsea has been unable to collect council tax following a cyber-attack in November 2025, meaning households who pay their bills by direct debit are now being asked to pay large lump sum payments as systems are switched back on.

Following the attack last November, the council isolated its systems to keep them safe. This impacted many of its functions and services, including its ability to collect council tax.

The council has now switched systems back on, meaning households are being asked to pay between £274 and £1,095 in one go.

The council confirmed that during the November cyber-attack, some resident data was copied.

It said in a statement, updated this week (16 March): “We confirmed a data breach with the Information Commissioner's Office at the earliest opportunity and have provided updates both online and by writing to more than 100,000 households with guidance on what to do if they had any concerns.”

The council said it is working with independent cybersecurity specialists to carry out a “thorough forensic review” of the data copied during the attack - prioritising any sensitive or higher-risk personal information.

Cllr Elizabeth Campbell, leader of Kensington and Chelsea Council, said: “When we were hit by the criminal cyber-attack last November, we isolated our systems to keep them safe. This impacted many of our functions and services, including our ability to collect council tax. We know this has been frustrating and we sincerely apologise to our residents for the inconvenience. After the attack we communicated regularly with residents to explain that payments would be collected at a later date and to keep money in their accounts to cover this.

“Now after advice from cyber security experts we have confirmed that the threat has been contained, enabling us to carefully switch systems back on. We are collecting council tax again and are writing to residents with their adjusted bills advising them to look at the FAQ’s on the website. We understand the impact of big bills and for most residents this will be a maximum of three months. 

“We have support available for people who are worried about paying the bill and our customer service centre is taking calls from residents who need help understanding the bill."

The amount that households pay for council tax will vary depending on how they pay their bills. Some people pay over 10 months, while some pay over 12.

Also in this section

Sep 11, 2026

Anthropic discloses fourth incident of AI model attacking real systems and hands investigation to independent evaluation organisation

Anthropic has published details of four incidents in which its Claude models gained unauthorised access to real third-party systems during cybersecurity evaluations, downloading and modifying user records at a real company, reading the personal information of an individual, harvesting credentials and accessing a security vendor's live database, after the test environments were mistakenly…
Sep 10, 2026

Welsh environmental watchdog hit by data breach

Environmental regulator Natural Resources Wales (NRW) has reported itself to the Information Commissioner's Office after a data breach saw personal details of staff made public.
Aug 24, 2026

Ministers seek power to ban tech risky vendors from critical sectors and bar recipients from discussing the order

The government has tabled amendments to the Cyber Security and Resilience (Network and Information Systems) Bill that would allow the Secretary of State to direct operators of essential services, data centres, managed service providers and other designated organisations to stop buying from, restrict the use of, or remove and disable products from a named vendor on national security grounds, with…
Aug 12, 2026

ACRO Criminal Records Office reprimanded by ICO following cyber security failings

The Information Commissioner's Office (ICO) has urged organisations to strengthen “patching and security monitoring processes” after cyber security failings at ACRO Criminal Records Office left the personal information of up to ten-thousand people, including some individuals’ sensitive data, potentially exposed.
Aug 06, 2026

AI agents sent malicious files to real developers and planted prompt injections in unmonitored test: AISI

The AI Security Institute (AISI) has published an incident report disclosing that AI agents under evaluation in its research environment took sustained, unsanctioned action against real people and organisations on the live internet, including researching the human maintainers of an open-source project, creating fake online identities to pressure one of them into approving malicious code, and…
Aug 05, 2026

Third AI platform goes rogue during cyber testing

The AI Security Institute (AISI) has reveaked a security incident in which AI agents being evaluated for their cyber capabilities took sustained, unsanctioned action directed at real people and organisations, including an attempted supply-chain attack on a publicly used open-source software project.

InfoGov Masthead Newsletter 800