Soaring cost of protecting hospital and council computers revealed after wave of cyber attacks

The soaring cost of keeping council and health board computer systems safe can be revealed today in the wake of several major cyber attacks across Scotland.

Public bodies are handing out millions of pounds to protect themselves from hackers tooled with increasingly sophisticated techniques – including an emerging wave of “adversaries” using artificial intelligence (AI) software.

Our investigation found some authorities are being forced to fork out more than six times as much for cyber security as they did just a few years ago.

Meanwhile, health officials told us they are having to block up to 25,000 unauthorised attempts to access their computer networks “on a daily basis”.

Some authorities refused to provide information out of fear that even the smallest details could be seized on by criminal gangs looking to break into their systems.

But those that did revealed a picture of spiralling costs against an increasing onslaught that has wreaked havoc on services in recent months.

Shrinking budgets

Cyber security expert Xavier Bellekens warned public bodies are struggling to keep their networks safe against shrinking budgets.

Bellekens, who is CEO and co-founder of Lupovis – a cyber-deception spin-out of Strathclyde University, said: “Cyber attacks come in waves and some adversaries will target a very specific sector.

“Whether its health boards or councils, the public sector in general is having to do what they can with the money they have.

“Sometimes they have a limited budget and the more cyber attacks and damage being done, the more the budget gets increased.

“But often the budget in the public sector is still a lot lower than you would see in industry.

“I think this is being recognised in the public sector and there are efforts being done to strengthen it to get the maximum impact for the budget they have.”

Data reveals soaring bills

Official figures released through Freedom of Information legislation show spending on cyber security by Perth and Kinross Council soared by more than six times, from just over £48,000 in 2021 to more than £303,000 last year.

Spending in West Dunbartonshire almost tripled during the same period, from nearly £99,000 to around £294,000.

Members of the public shouldn’t have to worry whether someone is looking after their sensitive information.

Scottish Conservative MSP Craig Hoy

East Dunbartonshire saw costs for firewalls, locked down servers, intrusion prevention systems and end-point-security rise from £21,000 in 2021 to £115,000 this year.

Meanwhile, the Highlands and East Renfrewshire saw the share of their budgets swallowed up by cyber security balloon to £3.2 million and £1.4 million respectively.

Health chiefs in Dumfries and Galloway saw costs more than double from around £50,000 to £117,000 last year, while NHS Fife saw a rise from £567,000 to £649,000 during the same period.

Local authorities told us their systems are coming under such a barrage of attacks that most are never officially recorded.

NHS Tayside said its firewalls alone detect around 25,000 unauthorised access attempts to its network on a daily basis.

However, the Scottish Borders Council had the highest number of recordable attacks – typically regarded as the most serious – over the past five years, at 568.

A string of major attacks

Glasgow City Council was forced to deal with disruption to digital and online services on Thursday after discovering malicious activity on its servers.

Another major incident in Glasgow last month disrupted multiple online services and led to fears that personal data may have been stolen.

In May, pupils in Edinburgh were cut off from revision resources during the annual exam period after an attempted cyber attack on the council’s education department.

It came on the same week that a suspected criminal ransomware attack in West Lothian forced officials to resort to contingency measures to keep schools open.

And last year, hackers managed to access a huge amount of NHS Dumfries and Galloway information – including confidential details on patients and staff.

Transparency needed

Scottish Conservative local government spokesman Craig Hoy said the latest figures show the considerable lengths public bodies have gone to beat crooks and hackers.

“As attacks on Edinburgh and West Lothian showed us recently, there is a battle being fought over our personal data,” he said.

© Duncan Bryceland/Shutterstock

“The amount of public money being spent on this is rocketing, despite year-on-year cuts to councils by the SNP government.

“Troublingly, some local authorities seem not to know how much effort is going into keeping their data safe. Others won’t reveal whether there have been any breaches in security.

“But there should be a basic level of transparency. Members of the public shouldn’t have to worry whether someone is looking after their sensitive information.”