UK government adviser admits data exposure of 51 officials

UK Government Investments (UKGI), the corporate finance adviser to the UK government, disclosed a data breach where an internal file containing sensitive information was publicly accessible for approximately 40 hours, according to The Register. The incident occurred during the 2025-26 financial year due to an employee failing to adhere to established information security policies.

The exposed document contained the names and work email addresses of 51 government officials, along with "high-level management information." UKGI, a Treasury-owned entity, voluntarily reported the breach to the UK's Information Commissioner's Office, although it did not meet the mandatory notification threshold.

An external review was commissioned, which concluded that UKGI's response was appropriate and recommended further improvements to security controls and incident preparedness. The report indicated that most of these recommendations have been or will be implemented. The exact timing, hosting location, and whether the data was accessed remain undisclosed. This incident occurred during a period when UKGI was involved in significant government commercial deals, including the sale of NatWest shares and advising on small modular reactor financing.

Source: The Register

Written by

Kelley Damore Chief Content Officer CyberRisk Alliance

Kelley Damore is Chief Content Officer at CyberRisk Alliance, where she leads content strategy across the company’s digital brands, research, communities and live events serving CISOs and security practitioners. At CyberRisk Alliance, she is focused on delivering 365-day engagement, trusted journalism and actionable insights to help security leaders navigate an increasingly complex threat landscape.