Labour says party members’ data breached in ‘cyber incident’

Personal details were among a ‘significant quantity’ of data affected

Labour party's website (PA)

Labour has revealed that personal information given by party members and supporters is among data breached in a “cyber incident” at a firm which helps run its IT systems.

The opposition said it had been told a “significant quantity of party data” had been affected by the incident on 29 October, and has reported the matter to the authorities.

The National Crime Agency (NCA), National Cyber Security Centre (NCSC) and the Information Commissioner’s Office (ICO) have all been informed, the party said.

In a statement to members, Labour said: “A third party that handles data on our behalf has been subject to a cyber incident. The incident had resulted in a significant quantity of party data being rendered inaccessible on their systems.”

The statement added that the breached data “includes information provided to the party by its members, registered and affiliated supporters, and other individuals who have provided their information to the party.”

It said it was “working closely and on an urgent basis” with the IT firm in order to understand the full scope and impact of the incident – but it is not yet know how many people have been hit by the breach.

The party also confirmed that its membership website has been down for several days, though a spokesman said Labour’s own data systems were “unaffected” by the breach.

The NCA said it is leading a criminal investigation into what happened. “We are working closely with partners to mitigate any potential risk and assess the nature of this incident,” said an agency spokesperson.

Labour urged members and supporters who may have been affected to take extra precautions online, in line with NCSC guidance.

A NCSC spokesman said: “We are aware of this issue and are working with the Labour Party to fully investigate and mitigate any potential impact.

“We would urge anyone who thinks they may have been the victim of a data breach to be especially vigilant against suspicious emails, phone calls or text messages and to follow the steps set out in our data breaches guidance.”

It is not the first time Labour has seen its IT systems compromised. In November 2019, during the general election campaign, the party was the victim of a “large and sophisticated” cyber attack as hackers attempted to take down the website.

And in May 2020, personal information held by Labour was among the data breached following a cyber-attack on cloud computing provider Blackbaud.