Loading story…
The UK government has publicly acknowledged that its longstanding cybersecurity policies for the public sector have failed, leaving critical services and departments vulnerable to cyberattacks. In response, officials have announced a sweeping reset with the introduction of the Government Cyber Action Plan, backed by over £210 million in new funding. The plan establishes a dedicated Government Cyber Unit, sets minimum security standards, and mandates robust incident response capabilities across all departments. This overhaul comes after years of fragmented accountability and recurring cyber incidents, including high-profile attacks on agencies such as the Legal Aid Agency (LAA), which suffered a major breach that went undetected for months despite significant prior investment in security improvements.
The Public Accounts Committee has criticized the Ministry of Justice for its handling of the LAA cyberattack, revealing that despite £50 million spent on security, the agency failed to detect the intrusion for four months and delayed taking affected servers offline. The government’s new strategy aims to address these systemic weaknesses by improving risk visibility, enforcing stricter standards, and banning ransom payments by public-sector organizations. The action plan is positioned as a radical shift to protect essential services, restore public trust, and prevent future incidents that could disrupt healthcare, legal, and other critical infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
Major UK mobile providers agreed to upgrade their systems to help prevent phone number spoofing under a government-backed anti-fraud partnership.
The government said it is moving to prohibit ransom payments by public-sector bodies and critical infrastructure organizations as part of broader cyber resilience reforms.
The government said the action plan's build phase would run through April 2027, followed by scaling and improvement work through 2029 and beyond.
Before the January 2026 action plan launch, the UK government pursued the Cyber Security and Resilience Bill to impose minimum standards and faster incident reporting for critical infrastructure and public services.
The action plan introduced a Software Security Ambassador Scheme with major industry participation to promote secure software development and reduce software supply-chain risk.
As part of the new plan, the government said it would create a Government Cyber Unit within DSIT to oversee policy, risk management, incident response, and supplier accountability, alongside a new Government Cyber Profession to build talent.
The UK announced a new Government Cyber Action Plan backed by more than £210 million, shifting to a centralized and mandatory approach for improving public-sector cyber resilience.
The UK government publicly acknowledged that years of cybersecurity policy had failed to adequately protect government organizations and that existing efforts would not meet its 2030 security goals.
The Ministry of Justice did not detect the Legal Aid Agency cyberattack until April 2025, months after the intrusion began, highlighting significant monitoring and response gaps.
A major cyberattack against the Legal Aid Agency began in December 2024, eventually compromising a large volume of sensitive data, including information related to legal aid applicants.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
bankinfosecurity.com
Open sourcego.theregister.com
Open sourcebleepingcomputer.com
Open sourcehelpnetsecurity.com
Open sourcetechrepublic.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybersecurity threats targeting the public sector have intensified, with government agencies and critical services such as healthcare facing increasingly sophisticated and frequent attacks. Motivations for these attacks range from political influence and financial gain to the theft of sensitive citizen data, which is often sold on the dark web. The consequences of breaches in public sector systems are severe, potentially endangering lives, disrupting essential services, and eroding public trust. Healthcare, in particular, has become a prime target due to the high value of medical data, the critical nature of uninterrupted operations, and the prevalence of outdated or insecure systems, making it especially vulnerable to ransomware and other cyber threats. Despite the growing threat landscape, policy responses have not kept pace. In the UK, the proposed Cyber Security and Resilience (CSR) Bill notably excludes central and local government from its scope, drawing criticism from lawmakers and experts who argue that public sector entities should be held to stringent cybersecurity standards. While the government has introduced a Cyber Action Plan to address some of these concerns, the lack of comprehensive legislative coverage leaves significant gaps in the nation’s cyber defense posture. The urgency for robust, sector-wide cybersecurity measures is underscored by the rising frequency and impact of attacks on public institutions, particularly in healthcare, where operational disruptions can have life-threatening consequences.
Jun 29, 2026
The United Kingdom has experienced a dramatic increase in the number and severity of cyberattacks targeting its organizations, as highlighted in the National Cyber Security Centre's (NCSC) latest annual review. Over the past year, the NCSC incident management team responded to 429 cyberattacks, a figure nearly identical to the previous year, but the proportion of attacks classified as 'nationally significant' rose sharply to 204, representing a 48% increase. The number of 'highly significant' attacks, which have a serious impact on central government, essential services, or a large segment of the population, also increased by 50%, reaching 18 incidents. These highly significant attacks are just one step below a national cyber emergency and require coordinated responses from senior government officials and law enforcement. The NCSC categorizes incidents on a six-level scale, with the most severe being those that disrupt critical services or threaten national security. The government has responded to this surge by issuing direct communications to chief executives and business leaders, urging them to take concrete steps to bolster their cyber resilience. This includes the recommendation to maintain physical, offline copies of cyberattack contingency plans, as digital systems may be rendered inaccessible during an incident. The advice comes in the wake of high-profile attacks on major UK companies such as Marks and Spencer, The Co-op, and Jaguar Land Rover, which resulted in empty shelves and halted production lines due to IT system outages. The attack on Jaguar Land Rover, in particular, was described as an economic security incident, with prolonged disruption threatening the government's economic growth objectives. The NCSC's annual review emphasizes the need for organizations to adopt resilience engineering strategies, focusing on the ability to anticipate, absorb, recover, and adapt to cyber threats. Firms are encouraged to plan for operations without IT systems and to develop alternative communication methods in the event of a cyberattack. The review also notes that while the overall number of incidents handled by the NCSC has remained stable, the increasing severity and sophistication of attacks pose a growing threat to national security and economic stability. The British government is taking a proactive stance by alerting industry leaders to the heightened risk environment and the necessity of robust cyber defense measures. The NCSC's chief executive, Richard Horne, has underscored that cybersecurity is now a matter of business survival and national interest. The review's findings have prompted calls for greater collaboration between government, industry, and academia to address the evolving threat landscape. The rise in significant cyberattacks is attributed to more intense, frequent, and sophisticated hostile activity targeting British businesses and critical infrastructure. The NCSC's categorization system helps prioritize response efforts and ensures that the most severe incidents receive the necessary attention and resources. The government’s outreach to business leaders is intended to drive home the urgency of preparing for cyber incidents that could have far-reaching consequences. The review also highlights the importance of learning from recent incidents to improve future response and recovery efforts. Organizations are advised to regularly test and update their contingency plans, ensuring that they are practical and accessible in a crisis. The NCSC continues to provide guidance and support to organizations across the UK, aiming to strengthen the country's overall cyber resilience. The increase in nationally significant and highly significant attacks marks the third consecutive year of rising severity, signaling a persistent and escalating threat. The government’s message is clear: cyberattacks are not just an IT issue but a critical risk to business continuity and national prosperity. The NCSC’s annual review serves as both a warning and a call to action for all sectors to prioritize cybersecurity and resilience in the face of mounting cyber threats.
Jun 29, 2026
The UK government has launched a voluntary **Cyber Resilience Pledge** at 10 Downing Street, asking companies to elevate cybersecurity to a board-level responsibility, enroll in the National Cyber Security Centre’s **Early Warning** service, and push suppliers toward **Cyber Essentials** certification or an equivalent baseline. The initiative includes a 30/60/90-day timetable for organizations to register for warning services, assess supplier coverage, and implement the Cyber Governance Code of Practice with annual board training. More than 60 organizations signed at launch, including over 20 of the government’s 39 strategic suppliers and companies such as Aviva, London Stock Exchange Group, Marks & Spencer, and Capita. The rollout drew scrutiny because uptake among major British firms was limited, with fewer than 15 **FTSE 350** companies joining despite ministers having written to every FTSE 350 chair and chief executive months earlier. The pledge has no enforcement mechanism, raising questions about whether it is primarily a public commitment ahead of possible future regulation through the proposed **Cyber Security and Resilience Bill**. The launch comes as cyber incidents continue to rise in the UK, with attacks estimated to cost organizations **£14.7 billion annually** and the NCSC reporting **204 nationally significant incidents** in the year to September 2025, up from 89 the previous year.
Jul 9, 2026