Loading story…
UK Government Investments (UKGI), the UK public body that manages state investments, disclosed a data breach after an internal file was left publicly accessible for about 40 hours. The exposed file contained high-level management information along with the names and work email addresses of 51 government officials, and UKGI said the incident was caused by a staff member failing to follow established information security policies.
UKGI said the breach was identified during the 2025–26 financial year, escalated to its board, and voluntarily reported to the UK Information Commissioner’s Office. The agency also commissioned an external security review, which found its response appropriate but recommended stronger security controls and better incident preparedness; UKGI said most of those measures have already been implemented or are planned.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
During the 2025-26 financial year, a UK Government Investments employee failed to follow security policies and left an internal file publicly accessible for around 40 hours. The file contained high-level management information and the names and work email addresses of 51 government officials.
UKGI publicly disclosed the incident in its annual report for the 2025-26 financial year. The disclosure stated that an internal file had been publicly accessible for about 40 hours and exposed 51 officials' names and work email addresses.
UKGI said the overwhelming majority of the external review's recommendations have already been implemented or are scheduled for introduction in the coming months. The measures focus on strengthening controls and incident preparedness.
UKGI brought in external experts to review the incident and its security protocols following the exposure. The review concluded UKGI's response was appropriate and recommended stronger security controls and improved incident preparedness.
After discovering the exposure, UKGI escalated the incident to its board or Audit and Risk Committee and voluntarily reported it to the UK Information Commissioner's Office. UKGI said the incident did not meet the threshold for mandatory ICO notification.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetheregister.com
Open sourcetheguardian.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Personal data for more than **100,000 UK police officers and staff** was reportedly leaked on the dark web after a major breach affecting multiple government bodies. Exposed information included **full names and contact details**, with reporting indicating the incident also impacted the **Ministry of Defence**, **Home Office**, **National Crime Agency**, and **Crown Prosecution Service**, adding to concerns over the exposure of sensitive law-enforcement and government personnel records. The intrusion has been attributed in reporting to the cybercriminal group **ExfilSquad**, which allegedly listed the victims on its leak site and claimed the access stemmed from **Microsoft Power Apps** and **Dynamics 365** misconfigurations. Specifically, the group said improperly configured permissions on **Dataverse** tables enabled the data exposure, and the breach was reported after a separate recent compromise involving the **Department for Education**.
Aug 4, 2026
The UK Department for Education confirmed a cyber attack after a previously unknown group, **ExfilSquad**, claimed it had stolen about **607,000 records** from the department’s Help Desk Self-Service Portal and Turing Scheme Portal. The exposed data reportedly included names, email addresses, telephone numbers, and job titles linked to parents, school leaders, university staff, and government officials. The attackers allegedly sought to extort the department by threatening to publish the data rather than encrypt systems, indicating a **data-theft-and-extortion** operation. The department said it had contained the incident and was working with the **National Cyber Security Centre** and **National Crime Agency** on the investigation. The breach lands amid persistent cyber pressure across UK education, where the government’s 2025/2026 breaches survey found incidents were identified by **49% of primary schools**, **73% of secondary schools**, **88% of further education colleges**, and **98% of higher education institutions**. **Phishing** remained the most common threat, while further and higher education institutions reported broader exposure to impersonation, malware, denial-of-service, and unauthorized access, along with greater operational impact. The survey said education institutions generally maintain stronger governance and technical controls than businesses, but weaknesses in **supply-chain security** and **patch management**, combined with budget and staffing constraints and rising concern over **AI-enabled social engineering**, continue to leave the sector exposed.
Aug 11, 2026
Organizers of **Abu Dhabi Finance Week (ADFW)** inadvertently exposed sensitive identity documents for roughly **700 attendees** after an associated **cloud storage server was left publicly accessible**. Reporting indicated the exposed files included **passport scans, national ID cards, and other personally identifiable information**, affecting high-profile individuals such as former UK Prime Minister **David Cameron** and other global finance and government figures. An independent security researcher reportedly discovered the dataset using common cloud-scanning tools, and the data may have been accessible for **at least two months** before being addressed. The incident underscores ongoing risk from **misconfigured or unsecured cloud storage** supporting major events and third-party registration workflows, where large volumes of identity documents are collected and retained. Other items in the provided set cover unrelated topics (post-quantum planning, phishing kits, supply-chain malware on Android devices, and general security roundups/advice) and do not add material facts about the ADFW exposure.
Jul 12, 2026