UK government adviser admits data exposure of 51 officials

As reported by The Register, UK Government Investments (UKGI), the corporate finance adviser to the UK government, has disclosed a data breach where an internal file containing sensitive information was publicly accessible for approximately 40 hours. The incident occurred during the 2025-26 financial year due to an employee failing to adhere to established information security policies.

The exposed document contained the names and work email addresses of 51 government officials, along with "high-level management information." UKGI, a Treasury-owned entity, voluntarily reported the breach to the UK's Information Commissioner's Office, although it did not meet the mandatory notification threshold. An external review was commissioned, which concluded that UKGI's response was appropriate and recommended further improvements to security controls and incident preparedness. The report indicated that most of these recommendations have been or will be implemented.

The exact timing, hosting location, and whether the data was accessed remain undisclosed. This incident occurred during a period when UKGI was involved in significant government commercial deals, including the sale of NatWest shares and advising on small modular reactor financing.

Source: The Register