When Marks & Spencer fell victim to a serious cyberattack, the media response was unforgiving. Management was widely criticised for failing to protect customer data, and the company now faces legal action that could cost millions of pounds in compensation.
Against that backdrop, it is reasonable to ask: what exposure does the Royal Borough of Kensington & Chelsea face following its own serious cyber incident? Are residents and suppliers able to pursue claims for losses and distress, or is the Council effectively sheltered from legal liability?
It has now been weeks since RBK&C disclosed a major cyberattack that resulted in data breaches.
The usual bureaucratic PR stunt is…”we have set up a GOLD COMMAND” as if that is meant to reassure.
The consequences for residents have been severe. Payments and refunds cannot be processed, leaving some facing real financial hardship and distress. Despite this, there appears to be little clarity or public visibility on when systems will be restored. For many affected residents, there is no end in sight.
The incident inevitably raises questions about the robustness of the Council’s cybersecurity arrangements. Several of the Dame’s contacts describe the breach as “an accident waiting to happen”. That assessment is echoed by neighbouring authorities: both Westminster City Council and Hammersmith & Fulham have reportedly been impacted as a result of RBK&C’s infection.
The Dame understands that responsibility for IT at the Council sits with Darren Mann. His publicly available LinkedIn profile indicates that he works on a “hybrid” basis and lives near Bicester — some 70 miles from Hornton Street.
IT MANN HIT
What does “hybrid” mean in this context, and how does remote or semi-remote working align with the management of critical systems during a live cyber crisis?
More broadly, there is growing concern about accountability in local government. Senior officers appear insulated from scrutiny in a way that their counterparts in the private sector are not. In a listed company, executives responsible for a failure of this magnitude would expect intense public and shareholder examination.
In Mr Mann’s case, his CV notes previous employment with Tata Consultancy Services — the same consultancy that was heavily criticised for its role in the Marks & Spencer IT failure. That connection, at the very least, raises further questions about lessons learned and due diligence.
Residents deserve answers: about data protection, about compensation, about system recovery, and about who is accountable when things go wrong. Silence, opacity and delay only deepen the sense that this crisis was foreseeable — and mishandled.
PS The Dame, out of courtesy, gave Maxine Holdsworth and the head of HR sight of the draft and an invitation to comment. No response.
Leave a Reply