UK government investment arm cops to 40-hour leak of officials' contact details
Employee failed to follow security policy, leaving internal management file open to the public
The UK government's corporate finance advisory firm, UK Government Investments (UKGI), has acknowledged a security lapse that exposed the personal contact details of 51 government officials for approximately 40 hours. This revelation surfaced within the organization's annual report for the 2025-26 financial year. According to the report, the breach resulted from an employee's failure to adhere to established information security protocols.
The compromised document contained sensitive high-level management information along with the names and work email addresses of the officials. Despite the breach not meeting the criteria for mandatory disclosure, UKGI promptly reported the incident to the UK's Information Commissioner's Office, as well as to its Audit and Risk Committee, and commissioned an external review of the matter.
The report, however, provides scant specifics, failing to disclose the timing of the exposure, the location of the file, whether any unauthorized access or downloads occurred, or the identity of the external firm that conducted the review. The review concluded that UKGI's response was appropriate, albeit recommending further enhancements to security measures and incident preparedness.
Notably, the majority of these recommendations have either been implemented or are scheduled for implementation in the near future. This incident unfolds amidst a year marked by significant commercial transactions overseen by UKGI, including the final sale of the government's remaining shares in NatWest, advising on financing for small modular reactors, and supporting capital raises for Eutelsat and Royal Mail.
The Register has reached out to UKGI for additional information, specifically regarding the extent of the exposed information, the file's accessibility period, evidence of any unauthorized access during the exposure period, and any new security enhancements implemented since the breach. The full implications of this lapse, ranging from mere embarrassment to potential risks to the officials, remain unclear pending further disclosure by UKGI.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
