Loading story…
The UK Foreign Office confirmed it suffered a cyberattack discovered in October, with senior ministers publicly acknowledging the breach but withholding specific details pending the outcome of an ongoing investigation. While some media reports have speculated that Chinese state-sponsored actors were responsible and that visa application data may have been compromised, government officials have cautioned that these claims are unverified and that no evidence currently suggests individuals have been harmed. The Foreign Office stated that the security vulnerability was quickly addressed and that the investigation is focused on determining the full scope and impact of the incident.
The breach is particularly concerning due to the sensitive nature of the Foreign Office's systems, which handle classified diplomatic communications and intelligence. The attack occurred during a period of heightened diplomatic activity, raising concerns about potential exposure of critical statecraft information. Official attribution has not been made, but the sophistication of the attack has led to speculation about state-sponsored involvement. The incident highlights ongoing cyber risks to UK government infrastructure, with recent data showing a significant number of nationally significant cyber incidents handled by the National Cyber Security Centre over the past year.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
On December 19, 2025, trade minister Sir Chris Bryant confirmed in Parliament that the Foreign Office had been hacked. He said many reported details about attribution and the scale of data theft remained unverified and that the current assessed risk to individuals was low.
Initial press reports claimed Chinese-linked group Storm-1849, also known as UAT4356, was responsible and that visa or personal data had been stolen. These claims were widely reported but were not confirmed by UK officials.
After discovering the breach, the government said it moved quickly to close the vulnerability and contain the incident. The Foreign Office and the National Cyber Security Centre began investigating the attack and assessing any risk to individuals.
The UK's Foreign, Commonwealth and Development Office discovered a cyberattack in October 2025 affecting its network. Officials have not disclosed which systems were impacted or provided technical details of the intrusion.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
4 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcetechrepublic.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK Department for Education confirmed a cyber attack after a previously unknown group, **ExfilSquad**, claimed it had stolen about **607,000 records** from the department’s Help Desk Self-Service Portal and Turing Scheme Portal. The exposed data reportedly included names, email addresses, telephone numbers, and job titles linked to parents, school leaders, university staff, and government officials. The attackers allegedly sought to extort the department by threatening to publish the data rather than encrypt systems, indicating a **data-theft-and-extortion** operation. The department said it had contained the incident and was working with the **National Cyber Security Centre** and **National Crime Agency** on the investigation. The breach lands amid persistent cyber pressure across UK education, where the government’s 2025/2026 breaches survey found incidents were identified by **49% of primary schools**, **73% of secondary schools**, **88% of further education colleges**, and **98% of higher education institutions**. **Phishing** remained the most common threat, while further and higher education institutions reported broader exposure to impersonation, malware, denial-of-service, and unauthorized access, along with greater operational impact. The survey said education institutions generally maintain stronger governance and technical controls than businesses, but weaknesses in **supply-chain security** and **patch management**, combined with budget and staffing constraints and rising concern over **AI-enabled social engineering**, continue to leave the sector exposed.
Aug 11, 2026
The French Interior Ministry confirmed a cyberattack that compromised its email servers, allowing attackers to access certain document files. In response, the ministry implemented enhanced security protocols and access controls, while an investigation was launched to determine the origin and scope of the breach. Authorities have not yet confirmed whether any data was stolen, and are considering multiple possible motives, including foreign interference, hacktivism, or cybercrime. The Interior Ministry, which oversees police, internal security, and immigration, is considered a high-value target for both state-sponsored and criminal actors. The incident was reported in several news roundups, highlighting its significance within the broader context of European cybersecurity threats. While attribution has not been established for this specific attack, previous campaigns against French government entities have been linked to Russian state-sponsored groups such as APT28. The breach underscores ongoing concerns about the vulnerability of critical government infrastructure to sophisticated cyber threats and the need for robust incident response and investigation procedures.
Jun 29, 2026
Reporting indicates **China-linked intelligence activity** is targeting current and former Western government officials through both human and technical collection. In the US case, a suspected Chinese influence/collection network using a purported consultancy (*Foresight and Strategy*) allegedly approached a former senior State Department official and offered payment to produce an assessment of US policy priorities in Venezuela, consistent with prior research describing a nexus of fake companies and websites used to recruit people with government and think-tank policy experience. In the UK, Chinese state-linked hackers are accused of maintaining years-long access to communications associated with senior Downing Street officials, with reporting alleging compromises affecting phones used by aides to former prime ministers **Boris Johnson, Liz Truss, and Rishi Sunak** dating back to 2021 and discovered in 2024. The activity has been linked by sources to **Salt Typhoon**, a China-aligned espionage group associated with telecom-provider intrusions that can enable collection of call metadata and potentially content (texts/calls), allowing intelligence value even without direct handset malware.
Jun 29, 2026