Councils 'unprepared' for cyber-attacks, report says