Cyber Incident Victim: Salford City Council
Date:
Nov 2024
Location:
United Kingdom
Summary
A pro-Russian hacking group known as NoName057(16) conducted distributed denial-of-service (DDoS) attacks against multiple UK local authorities, including Salford City Council, causing temporary website disruptions but no compromise of resident data or core services. The incident impacted several councils' online accessibility, with some taking systems offline temporarily while working to restore functionality; the National Cyber Security Centre provided guidance, noting such attacks are relatively unsophisticated but disruptive to legitimate service access.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On or around November 1, 2024, Salford City Council experienced a distributed denial-of-service (DDoS) cyber attack claimed by the pro-Russian hacker group NoName057(16). The attack formed part of a broader campaign targeting multiple UK local authorities, including Portsmouth, Middlesbrough, Bury, and Trafford councils. Attackers flooded council websites with excessive traffic to disrupt public access to online services. Salford Council confirmed temporary disruption to its website but emphasized no internal council services were compromised and no resident data was breached. The incident mirrored attacks on Portsmouth City Council, whose website became inaccessible for an unspecified period, though core services and payment systems remained operational through alternative platforms like MyPortsmouth. Middlesbrough Council proactively took its website offline on October 30 after its IT department detected anomalies, while Bury and Trafford councils reported similar temporary outages.
Salford Council restored its website functionality shortly after the attack, assuring residents of resumed normal operations alongside Bury and Trafford. Portsmouth Council issued public statements via Facebook, confirming the attack’s nature and advising residents to use alternative channels for service requests during the disruption. All affected councils maintained offline customer service operations during business hours despite online accessibility issues. The National Cyber Security Centre (NCSC) provided technical guidance to targeted councils, characterizing the attacks as relatively unsophisticated but disruptive to legitimate users seeking online services. NoName057(16) publicly claimed responsibility, aligning with its history of politically motivated DDoS campaigns. No councils reported data exfiltration or financial losses, with impacts limited to temporary website unavailability and minor operational inconveniences for residents attempting digital access during the attack window.