The November 2023 cyber-attack on Comhairle nan Eilean Siar is continuing to cast a shadow over services, councillors are being warned.

More than two years after the ransomware attack took down its computer systems, there continues to be a “significant backlog” putting council services under “sustained pressure”.

Recovery efforts are expected to continue well into 2026.

Reports coming before councillors next week reveal that while 60 per cent of recovery recommendations have now been fully implemented, key departments like revenues, benefits, and planning are still fighting to clear a massive backlog of data.

However, this latest update, dated March 2, confirms that the Comhairle is finally nearing the end of its “build back better” phase.

However, the strain on staff remains high. The Accounts Commission recently noted that “many services are still dealing with the backlog created by the attack, alongside day-to-day delivery,” praising staff who went ”‘above and beyond’ to mitigate impacts on service users, suppliers and the local community.”

The cyber-attack unfolded when a sophisticated ransomware attack encrypted nearly all of the council’s locally hosted servers.

The impact was “immediate and severe,” and resulted in a near-total loss of fileserver data. The most critical blow was dealt to the finance department; the loss of the general ledger meant that for months, the council could not match income to customers or monitor budgets effectively.

The damage was so extensive that auditors issued a “disclaimer of opinion” on the 2023/24 annual accounts – a rare move triggered because they were “unable to obtain sufficient audit evidence” to verify the council’s financial transactions.

While core IT systems are now operational, the task of re-entering historical data remains a manual, “substantial resource” drain.

In the revenues and benefits department, staff are still rebuilding systems by re-entering data through the “front end”

The financial hit is estimated at approximately £0.95 million, with £300,000 of that becoming a recurring annual cost to maintain a more resilient, cloud-based infrastructure.

However, the figures do not include the “indirect costs” of thousands of hours of staff time diverted from regular duties to emergency recovery, councillors are informed.

The Comhairle is now focused on completing its final security upgrades. Councillors are also set to receive a report by May 31 to define the council’s “risk appetite” and guide future investment priorities.