If It’s Not One Thing It’s The Other

Cyber attacks.

Almost two months on, the incident on 24 November 2025 which affected an IT system shared by Westminster City Council, the Royal Borough of Kensington and the London Borough of Hammersmith and Fulham is still causing delays in the processing of planning applications.

Westminster City Council confirmed on 14 January 2026 that many of its functions continue to be impeded. As to its planning functions, it is currently relying on manual processes and is only “making decisions on those [planning applications] that don’t require public or external consultation”(so, not many at all I assume!). It states in a series of FAQs that section 106 agreements are not being completed and CIL liability notices are unable to be issued. I’m sure that this is stressful for those working within the organisation but imagine the knock-on implications for development and for those of us advising those developers affected!

Similarly, RBKC has confirmed that it is unable to start processing planning applications that are submitted. Some data has apparently been copied and taken – and one can only assume that this may include personal information that would be redacted from that which would otherwise be publicly available. I hope this doesn’t impede people’s willingness in the future to engage in sensitive planning issues.

I can’t see equivalent advice on Hammersmith and Fulham Council’s website as to any current implications for its service, but Planning magazine reported on 13 January 2026 that the council has said that while it shares “some legacy systems” with the affected authorities, it had been able to “successfully isolate and safeguard our network.”

This is of course not the first time that local government IT systems have been compromised like this. That Planning magazine piece references attacks on Tewkesbury Borough Council and Gloucestershire City Council in 2022. People may also remember a disruptive attack on Hackney Council’s system in 2020 and there was also one on Redcar and Cleveland Council that year which is reported to have cost the council over £10m.

I’m sure this is all front of mind both for existing councils’ IT teams and for those planning for the move to unitary authorities. I just wonder if the associated business risk is being fully factored in by developers and investors. Does their insurance cover losses caused by resultant delays in receiving planning decisions? And what if a similar incident were to affect the Planning Inspectorate for instance? What back-up plans do organisations have?

And, finally, a point not directly related to any of this but relating to local government IT systems. Are the resources being made available to make sure that local government reorganisation includes full integration of authorities’ digital services? Search for a planning application on Buckinghamshire Council’s planning portal for instance and almost six years on you still undertake a memory test as to the geographic boundaries of its three former constituent authorities…

This is the 500th Simonicity post. Subscription is still free and, once we finalise the planning, subscribers should be receiving an email before too long now with details of a special event that is being planned to mark the blog’s tenth anniversary in June.

Simon Ricketts, 17 January 2026

Personal views, et cetera