Data breach affects city council

Ted Peskett Local Democracy Reporter

A data breach has led to the details of vulnerable children in Cardiff being compromised.

Members of Cardiff Council’s governance and audit committee were told about the data breach by a council official at a meeting on Tuesday, March 25.

The Local Democracy Reporting Service understands that information on children looked after by the council was taken in the breach that affected Data Cymru.

[mid-content-banner]

Update

Cardiff Council’s director of children’s services, Deborah Driffield, mentioned the data breach whilst presenting an update on risk management to governance and audit committee members.

Ms Driffield said at Tuesday’s meeting: “[There are] some issues around cyber security.

“We have had a data breach that we are currently managing and drawing up I think new arrangements in relation to this world of people stealing data and sharing it on the dark web and trying to understand how we can mitigate against that.

“That is a fairly new area for us, but we have shared the risks there and certainly are working with Welsh Government and Data Cymru and all of the other… local authorities on that.”

A council document, titled ‘Directorate Escalated Risk Register Quarter 3 2024/25’ highlights the cyber security failure.

It states under ‘risk description’: “A failure in cyber security results in a data breach and therefore a potential safeguarding risk to children”.

[lower-mid-content-banner]

Escalation

The risk, under the children’s services directorate, was escalated in January 2025.

Under ‘current controls’, the council document states that work has taken place with the national cyber security team.

It also states that risk assessments are being undertaken and that an action plan is under development.

The Local Democracy Service asked Data Cymru for the type of data that was compromised, when the breach occurred and what has been done to resolve the issue, but have not received a response.

Cardiff Council was also given an opportunity to respond.

Data Cymru is a Welsh local government company with a board of directors elected by the Welsh Local Government Association (WLGA).

It supports councils and their partners to collect data and works across local authority services to “provide support for benchmarking activities”.

Data Cymru’s website states: “This work includes provision of collection forms, management of the collection activity and providing data in usable intelligent formats.

“We provide support across the majority of services operating in local authorities.”