Loading story…
The Office for Budget Responsibility (OBR) inadvertently published its November 2025 Economic and Fiscal Outlook (EFO) online before the official Budget announcement, allowing journalists to access sensitive details by guessing the document's URL. The file, which was not directly linked or listed on the OBR website, was accessible approximately 40 minutes before the Chancellor's statement, revealing key policy measures such as a pay-per-mile charge on electric vehicles and a freeze on tax thresholds. OBR chair Richard Hughes publicly apologized for the incident, describing it as a serious error and expressing personal mortification over the breach of protocol.
In response to the premature disclosure, the OBR has launched a formal investigation overseen by its Oversight Board and supported by former National Cyber Security Centre chief Ciaran Martin, alongside Treasury IT and security specialists. The OBR attributed the leak to a technical error and has committed to reporting the findings to Members of Parliament. The incident has raised concerns about the handling of market-sensitive information and the adequacy of digital security practices within government agencies.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
Following the premature release, the OBR called in cyber expert Ciaran Martin to help investigate the incident and review whether cybersecurity or process failures contributed to the breach. This external review was reported as part of the OBR's response to the disclosure failure.
The UK Office for Budget Responsibility mistakenly published its Budget analysis before the planned release time, creating a leak of market-sensitive fiscal information. The botched publication prompted concern over how the embargo failure occurred.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
UK Government Investments (**UKGI**), the UK public body that manages state investments, disclosed a data breach after an internal file was left publicly accessible for about 40 hours. The exposed file contained high-level management information along with the names and work email addresses of **51 government officials**, and UKGI said the incident was caused by a staff member failing to follow established information security policies. UKGI said the breach was identified during the 2025–26 financial year, escalated to its board, and voluntarily reported to the UK Information Commissioner’s Office. The agency also commissioned an external security review, which found its response appropriate but recommended stronger security controls and better incident preparedness; UKGI said most of those measures have already been implemented or are planned.
Aug 4, 2026
The Congressional Budget Office (CBO), a nonpartisan federal agency providing budget and economic analysis to Congress, confirmed a cybersecurity incident attributed to a suspected foreign threat actor. Officials reported that the breach may have exposed sensitive communications between lawmakers and CBO analysts, as well as internal data such as draft reports and economic forecasts. The CBO responded by containing the incident, implementing additional monitoring, and enhancing security controls to protect its systems. The agency emphasized that work for Congress continues while the investigation is ongoing. The breach was detected early, according to officials, but concerns remain about the potential exposure of confidential information. Some congressional offices have reportedly suspended email communications with the CBO as a precaution. This incident follows a pattern of recent cyberattacks targeting U.S. government agencies, including the Treasury Department and the Committee on Foreign Investment in the United States, with attribution in those cases linked to Chinese state-sponsored actors. The CBO has requested increased funding to bolster its cybersecurity and IT infrastructure in response to the growing threat landscape.
Jun 29, 2026
The UK government has publicly acknowledged that its longstanding cybersecurity policies for the public sector have failed, leaving critical services and departments vulnerable to cyberattacks. In response, officials have announced a sweeping reset with the introduction of the Government Cyber Action Plan, backed by over £210 million in new funding. The plan establishes a dedicated Government Cyber Unit, sets minimum security standards, and mandates robust incident response capabilities across all departments. This overhaul comes after years of fragmented accountability and recurring cyber incidents, including high-profile attacks on agencies such as the Legal Aid Agency (LAA), which suffered a major breach that went undetected for months despite significant prior investment in security improvements. The Public Accounts Committee has criticized the Ministry of Justice for its handling of the LAA cyberattack, revealing that despite £50 million spent on security, the agency failed to detect the intrusion for four months and delayed taking affected servers offline. The government’s new strategy aims to address these systemic weaknesses by improving risk visibility, enforcing stricter standards, and banning ransom payments by public-sector organizations. The action plan is positioned as a radical shift to protect essential services, restore public trust, and prevent future incidents that could disrupt healthcare, legal, and other critical infrastructure.
Jun 29, 2026