Glasgow City Council has been hit by a cyber incident which it said may have involved the theft of customer data.
The council said the incident is disrupting a number of online services and investigations are under way.
The local authority said its ICT supplier CGI discovered “malicious activity” on servers managed by a third-party supplier on Thursday June 19.
Police Scotland are involved in investigating the incident, along with the council, the Scottish Cyber Co-ordination Centre and the National Cyber Security Centre.
It is the third time in recent months that a local authority has been hit by a cyber attack, after Edinburgh and West Lothian councils were targeted in May.
Glasgow City Council said no financial systems have been affected and no details of bank accounts or credit/debit cards processed by those systems have been compromised.
In a statement, the local authority said: “At this stage we can’t confirm whether data has actually been removed and, if so, what that data is.
“As a precaution, we are operating on the presumption that customer data related to the currently unavailable web forms may have been exfiltrated, and we have contacted the Information Commissioner’s Office on this basis.
Glasgow City Council is currently being impacted by a cyber incident which is disrupting a number of online services and which may have involved the theft of customer data.
— Glasgow City Council (@GlasgowCC) June 25, 2025
Read more here: https://t.co/xX8iqJnw49 pic.twitter.com/BwHuNoPenP
“Until such time as we can ascertain if data has been stolen, and what this may be, we advise anyone who has used any of the affected forms to be particularly cautious about any contact claiming to be from Glasgow City Council.
“Glasgow City Council apologises for the anxiety and inconvenience this will undoubtedly cause.”
The council said taking affected servers offline has disrupted a number of its day-to-day digital and online services.
This includes viewing and commenting on planning applications; paying penalty charges for parking or bus lane contraventions; reporting school absences, and ordering certificates from city registrars.
Some online diaries and calendars are not available – for example, household schedules for bin collections – while members of the Strathclyde Pension Fund are not currently able to access the SPFOnline portal.
The council said the loss of web-based services has been caused by the isolation of the servers, rather than the cyber incident.
Anyone contacted by someone claiming to have their data is advised to contact Police Scotland on 101 or call the Cyber Incident Response Helpline on 0800 1670 623.
