West Lothian Council Listed by interlock Ransomware Group

On 6 May 2025 the Interlock ransomware group added West Lothian Council to its public leak site, claiming that it had exfiltrated internal files during a ransomware attack on the Scottish local authority.

What's Publicly Reported from Reporting

Public reporting indicates that Interlock claims to have stolen unspecified internal documents from West Lothian Council, which provides education, housing, social care and economic development services to roughly 180,000 residents in central Scotland. The council has not yet issued a detailed public statement on the volume or exact nature of the data taken. Available reporting describes the listing on Interlock’s onion site but does not confirm whether a ransom demand was made or paid. No evidence has surfaced that customer, employee or resident personal data was published in full, yet the mere presence of the council on a ransomware leak page signals that sensitive material was removed from its systems.

Why This Matters for You and Your Family

When a local council is hit, the information at risk often includes names, addresses, dates of birth, National Insurance numbers, benefit claims, school records and correspondence about vulnerable residents. If any of those records belong to you or your family, the exposure can lead to identity theft, targeted scams or unwanted contact. Local authority breaches repeatedly surface in later fraud cases because attackers know councils hold data on almost every household in their area. Even when full datasets are not dumped immediately, the fact that files have left the organisation’s control creates a permanent risk that pieces of your information could appear on criminal forums months or years later.

The Doxxing and Identity-Chain Implications

Ransomware groups rarely stop at one dataset. Once internal files leave a council network they can be cross-referenced with earlier breaches to build detailed profiles. A leaked email from a school trip form, combined with a password reused on a shopping site and a child’s gaming username, quickly forms a chain that leads to full doxxing. Public reporting shows these chains frequently result in harassment, swatting or extortion attempts against ordinary families. Credential leaks like this one regularly cascade into account takeovers on gaming platforms, where children’s accounts become entry points for further targeting because they often share the same email address or recovery phone number as a parent’s council correspondence.

Interlock’s Publicly Known Track Record

Public reporting attributes Interlock with emerging in late 2023 and focusing on mid-sized public-sector and healthcare organisations across Europe and North America. Notable prior victims include several UK and US local governments and healthcare providers. The group’s typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of documents before encryption. It then uses dual extortion: threatening to publish stolen files on its leak site while also demanding payment to prevent encryption of remaining systems. Interlock maintains a relatively professional leak site and sets firm deadlines, often giving victims seven to fourteen days before releasing samples.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers and real identity so you can see exactly what chains back to the West Lothian Council breach.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next exposure is caught in hours rather than months.
• Rotate any password you used on West Lothian Council systems or related local authority portals anywhere else it appears, and switch on two-factor authentication through an authenticator app instead of SMS.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become the weakest link when council data leaks.
• Let remediation specialists handle takedown requests for any exposed personal records that surface on data broker sites or underground forums.

The West Lothian Council incident is a reminder that local government breaches now form part of the everyday risk landscape for ordinary families. Taking concrete steps today limits how far attackers can travel along the identity chains they are so eager to build. DoxxScan by GalaxyWarden delivers that protection through continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.