In October 2020, ransomware hit Hackney Council. In 2024 the ICO reprimanded the council, finding that attackers had exploited a dormant account with an insecure password and that patches were missing on some devices. The council disputes the findings. We review accounts monthly, enforce multi-factor sign-in and patch every device.