'Too many' Norfolk County Council staff and councillors failed to spot a fake email designed to test the authority's defences against a cyber attack, say leaders.
Concern over cyber threats on County Hall prompted officials to test security by sending out a simulated email.
But the move has left officials worried as many fell for it.
The county council says phishing attacks - where criminals send emails trying to trick recipients into revealing sensitive information or into installing malware by clicking on links - are one of the principal cyber threats facing the authority.
In response to those concerns, it sent a fake email with a link to staff and councillors to test how clued up they are in spotting such an attempt.
And they revealed their worries at how many failed to spot the con, although officials have not revealed how many did so.
Liberal Democrat county councillor Sue Catchpole asked about the email at a recent meeting of the Reform-led council's cabinet.
She said: "Having queried an email recently, I was advised that this was a test of how well staff and members were responding to training on digital security and following procedure.
"Could the cabinet member please advise how well we did and what he sees are the key potential digital threats to Norfolk County Council and how certain is he that he is doing all he can to prevent an IT system failure?"
Jason Butler, the council's cabinet member for efficiency, performance and pensions oversight, said: "All staff and members are required to complete mandatory training in information governance and data security.
"This is supplemented by periodic simulated phishing exercises, the most recent of which has now concluded. Their purpose is to help people recognise suspicious emails and to encourage reporting, and anyone who clicks a link receives immediate guidance and training at that point.
"Many colleagues correctly identified and reported the email, but the results show that too many did not and that further work is needed."
Mr Butler said the council would not publish the detailed results as that "would be of value to anyone seeking to attack the council".
But he said the findings would be used to target better training for workers and councillors.
Norfolk County Council's security systems have been fending off attempts to disrupt services or steal data for years, but earlier this year, officers said the risk of a major attack is growing more likely.
Mr Butler said phishing was one of the principal cyber threats facing County Hall.
Others included ransomware, supply chain attacks affecting third party providers, the growing use of artificial intelligence to make attacks more convincing and denial of service attacks - where attempts are made to overload a website or networks.
He said: "No organisation can guarantee it will never suffer a cyber-attack or a system failure. I am satisfied that the right controls are in place and are regularly tested, but I am not complacent, and this exercise shows why."
Share