Six months after a major cyber-attack, a council is still working on getting all of its services back to normal.
Gloucester City Council discovered its systems had been breached in December.
Liberal Democrat group leader Jeremy Hilton said was concerned personal information may have been compromised, adding "we've never had a guarantee that it hasn't".
Benefit payments, planning applications and house sales were all delayed after hackers compromised IT systems.
Mr Hilton said he was worried about "the time it has taken to recover our systems, it's far too long".
"I'm concerned about the potential cost to the taxpayer and also the big unanswered question is about whether personal data has been compromised", he added.
Labour group leader Terry Pullen, echoed those concerns and said if there has been a breach of people's personal information they have a right to know and "the council has a responsibility to inform them".
Authority leaders have set aside £630,000 to fund the recovery work but opposition councillors have criticised the lack of insurance, suggesting costs may run into the millions.
A separate cyber attack in 2020 cost Hackney London Borough Council around £10m.
In Gloucester, the malware is understood to have got in via an email sent to a council officer with insiders linking it to hackers operating out of Russia.
However, authority bosses have so far refused to officially confirm the attack is subject to a criminal investigation, as reported by the Local Democracy Reporting Service (LDRS).
Following the attack, the council has been unable to process land charge searches until recently, which house buyers need to complete a purchase.
This has left people trying to move house in "total limbo" over the last six months with some at risk of having mortgage offers rescinded.
Mr Pullen said although things are "very slowly" returning to normal, he added "no one expected it to take six months and there is still some way to go yet."