Oracle Fusion data breach

We have identified some issues with the implementation of our new Oracle Fusion system. This is the system we use for HR and Payroll, Finance and Procurement. 

Some personal data has been visible on the system to internal users. This primarily relates to personal email addresses and phone numbers. The information is no longer visible on the system other than for a genuine business requirement.  

At this point there is no evidence to suggest that personal information has been publicly available, only that this information has been potentially visible to internal users should someone want to find it. This includes: 

  • Lancashire County Council
  • West Lancashire Borough Council
  • Lancashire Fire and Rescue Service
  • Lancashire schools and academies

We understand that the breach occurred during our implementation of Oracle Fusion. The issue is contained to our internal system only and does not relate to an external cyber security incident.  

What we have done so far

We informed the Information Commissioner’s Office on 1 February 2023. This is a standard procedure following any data breach.  

Since we identified the breach, we have been working hard to understand the issues, secure data and improve our overall Fusion security.  

What you need to do

Any breach of data can be extremely concerning for a variety of reasons, and you are encouraged to remain vigilant and follow the below in the first instance: 

  • As part of security improvements, staff who do not have an @lancashire.gov.uk email address will need to change their password the next time they login to Fusion.  
  • Please remain vigilant about phishing emails or texts, and delete any suspicious mail (from your mailbox and deleted items); do not reply to the sender, click on any links or open any attachments. 
  • Any suspected or actual security weakness, threats, events or incidents on county council systems must be immediately reported. You can do this via the intranet A-Z. Search I > Information > Report an information security incident. 
  • If you process personal data for the county council and you have not already done so, you must complete the Information Governance Training.

Resetting your password 

See the Oracle Fusion password reset guide for advice on how to reset your password. 

Support available 

A dedicated phone number has been set up. The number is 0300 123 6782.   

Additionally, a dedicated email contact@lancashire.gov.uk has been set up if you would like to email us.  

Please visit the My Health and Wellbeing Website to access a range of support services, including the Employee Assistance Programme, which can offer you counselling and advice. 

If you would like to contact our Employee Assistance Provider (EAP) you can call them on 0800542301 or visit: www.employeeassistance.org.uk -

  • Access code - westlancs for West Lancashire Borough Council staff
  • Access code - lancsedu for School staff
  • Access code - lancsfire  for Lancashire and Rescue staff
  • Access code – lccsupport for Lancashire County Council staff

Visit the Citizens Advice Bureau for advice on banking security and fraud and how to protect your data.