Oxford City Council breach exposed 21 years of election worker records

Oxford City Council confirmed on June 19, 2025 that attackers had gained access to its network over the weekend of June 7 and 8 and reached historic records held on legacy systems. The authority, which provides services to roughly 155,000 residents, said automated security tools detected the intrusion and cut off the attacker's access.

The data at risk related to people who worked on elections the council administered between 2001 and 2022, a span of 21 years. That group included poll station staff and ballot counters, most of them current or former council officers. The council said there was no evidence of a mass download or extraction of data, and no evidence that the accessed information had been shared with third parties. It did not publish a breakdown of which categories of personal data were involved, nor a count of affected individuals.

Responding to the incident caused more than a week of disruption to council services. External cybersecurity specialists were brought in and the council took its main systems offline for forensic review, affecting functions including payment processing. Most systems had been restored by June 20, though the council warned that backlogs could still cause delays.

The council said it had contacted potentially affected individuals directly with details and support information, and had reported the incident to government authorities and law enforcement. It also said it would strengthen network defenses and access controls and decommission the vulnerable legacy systems.