By Carole Dennett
The Isle of Wight Council has confirmed it is contacting families after a phishing incident allowed an unauthorised individual brief access to a single council mailbox. The council says its security systems reacted quickly, limiting the intrusion to a “very short period”, but a precautionary review was carried out to identify any information that may have been exposed.
After initially declining to reveal the number of people affected, a council spokesman said the investigation revealed that a total of 69 children, young people and families were identified as potentially affected. Following a detailed review and individual risk assessment, 48 individuals were identified as potentially being identifiable from the information contained within the document and were therefore contacted directly as a precautionary measure. No financial information was involved.
The phishing email originated from a trusted supplier who had themselves been compromised. Although there is currently no evidence that any information was downloaded, shared or misused, the council says it cannot rule this out entirely and has therefore acted “on a precautionary basis”. Those affected, along with relevant safeguarding partners and schools, have been notified and offered advice and support.
The incident was detected through routine security monitoring, and the affected account was immediately secured. Specialist teams have since carried out a detailed investigation and introduced additional controls and monitoring to prevent further breaches.
The Information Commissioner’s Office has been notified.
Mal Butler