Claud Bilbao, VP Underwriting & Distribution at Cowbell UK, discusses the recent cyber attack that brought a UK energy facility to a standstill and why it’s so important councils take note.

For most, the reported Iranian-linked attack on a UK power generator, which knocked it offline for four days, is an incident only relevant to the energy sector and not a major concern for other organisations. Perhaps this is down to the fact that the generator was small enough that its loss barely registered at grid level, or because there were no widespread power cuts or other critical infrastructure disrupted.

But for me, that’s not the point. It was still unavailable for four days, and that same duration of disruption could have very different consequences for different organisations. And it’s that point that’s particularly important for councils, where the consequences of losing access to critical systems will almost always extend well beyond the organisation itself.

For this reason, the power generator case should be a wake-up call for councils, who must now consider what four days offline could do to services such as social care, housing, waste and benefits payments, and ask, are they adequately prepared for that possibility?

If a council went offline for four days

The first thing to note here is that a four-day outage for a local authority is not merely an IT headache. Unlike commercial enterprises that lose transactional revenue, a council’s disruption directly impacts vulnerable individuals, making it more a community crisis.

Some of the services particularly hard to maintain during prolonged downtime might include:

? Adult and Child Social Care: Digital case management systems hold vital care plans, medical notes, and safeguarding alerts. Switching to paper processes during an outage creates immediate operational friction and safety risks.

? Housing and Emergency Accommodation: Allocations and temporary housing placements rely on live database availability.

? Revenues and Benefits Payments: Disruption to emergency support payments or housing benefits immediately leaves financially vulnerable households in distress.

In addition, administrative portals can quite often afford temporary downtime, but statutory welfare services simply cannot, especially when a four-day outage creates a compound backlog that can take weeks, sometimes months, to clear.

How councils typically approach cyber resilience

If we look at how your average UK council prepares for the above scenario, a clear weakness becomes obvious. Typically, most spend heavily on preventing an attack and making sure compliance check boxes are ticked - which is understandable given councils are operating within a system where there’s a lot of emphasis on cyber security, governance, standards and prevention. But resilience is also about what happens when those defences fail: keeping services running mid-attack or recovering once systems can't just be switched back on.

It’s also worth mentioning here that the Government provides councils with access to funded cyber incident response support for severe incidents. But relying exclusively on central government emergency response is as risky a strategy as only focussing on prevention.

Central support, such as assistance from the National Cyber Security Centre (NCSC) or state-funded incident response teams, is designed as an emergency triage safety net for national security and major systemic threats. While central response teams are invaluable for high-level forensic analysis and threat containment, they’re not there to handle a council’s internal operational recovery. They will not rebuild custom housing databases, restore localised workflows, re-establish vendor connections, or cover the significant financial liabilities and third-party costs associated with an incident or breach. Central support provides the emergency services, but the council remains entirely responsible for rebuilding its own infrastructure and maintaining continuity.

It’s important to mention cyber insurance, too, which is something some councils opt for, but the vast majority don’t. Despite the fact that modern cyber insurance offers far more than just financial indemnity – continuous threat monitoring, proactive vulnerability alerts, and immediate access to specialised incident response panels that limit operational downtime, for example – FOI studies show that only a small fraction of UK local authorities hold an active policy.

This low adoption likely stems from a combination of factors. The first is that many public sector leaders historically assumed that central government would step in as an implicit underwriter during a catastrophic failure, meaning they didn’t see the need to insure against that risk themselves. Then there’s the issue of tight budgets, which quite often force leaders to prioritise immediate, visible frontline services over risk transfer solutions, and in turn lead to the opinion that cyber insurance is an optional administrative cost rather than a core resilience tool. And finally, a perceived complexity has shrouded traditional cyber insurance for years, with many viewing it as a static ‘payout in a drawer’ rather than an active service.

While tight budgets are unlikely to ease across the public sector any time soon, councils are becoming more aware of the limits of central government support, while also recognising the need to take greater responsibility for their own cyber resilience.

Advice for councils moving forward

As well as considering the benefits insurance can offer, my advice for councils in light of this recent attack is to prepare for prolonged outage. To do this, councils must shift their mindset from ‘if we experience a breach’ to ‘when we experience a breach…how do we operate offline?’ This includes regularly stress-testing manual, paper-based processes for Tier 1 services (specifically social care and emergency housing), and ensuring staff know how to deliver core statutory duties without access to central servers. It’s also wise to maintain isolated, non-networked communication channels (such as WhatsApp or SMS) so leadership can coordinate during a network lockdown.

Next up, it’s worth looking at the supply chain, which is often a council’s weakest link. Before an incident exposes a single point of failure, local authorities should ask vendors, at a minimum:

? What is your tested recovery time objective (RTO) if your software goes offline?

? Can our data be exported or accessed via an isolated backup if your main infrastructure is compromised?

? Do you maintain independent Cyber Essentials Plus or ISO 27001 certifications across your own supply chain?

My final piece of advice for councils is simple: if budgets and legacy systems mean you can’t protect everything equally, start with the systems where an outage would have the biggest impact on people. The following categorisation helps here:

? Tier 1 (Life, Safety, and Safeguarding): Social care systems, emergency housing, and public health data. These require continuous vulnerability monitoring, multi-factor authentication, and prioritised recovery protocols.

? Tier 2 (Financial and Operational Integrity): Payroll, benefits disbursement, and council tax administration.

? Tier 3 (Informational and Non-Urgent): Planning portals, public archives, and general web forms.

Overall, the above advice is about taking a clear, uncomplicated, and phased approach to risk. This is the only way local authorities can ensure their limited resources both protect the services that matter most to their communities and give local leaders the confidence to deliver essential public services, even during a disruption.