UK state investment agency discloses data breach exposing officials' details

A member of staff failed to follow established security procedures

The UK government body responsible for managing billions of pounds of state-owned assets has disclosed a data breach that left sensitive internal information and the work contact details of dozens of government officials publicly accessible for almost two days.

UK Government Investments (UKGI), which oversees the government's shareholdings in organisations including Channel 4 and the Post Office, said the incident was caused by a member of staff failing to follow established information security procedures.

The organisation said in its annual report that an internal file containing high-level management information remained publicly accessible for around 40 hours before the exposure was discovered and contained.

The file contained names and work email addresses of 51 government officials.

Internal security review launched

UKGI said the breach took place during the last financial year but did not disclose exactly when it occurred.

According to the agency, the incident was escalated to its board and reported to the regulator the Information Commissioner's Office (ICO).

The organisation also commissioned external cybersecurity specialists to examine its security arrangements. Their review recommended stronger internal controls and improved preparedness for future incidents.

UKGI said it had already implemented most of the recommendations and planned to introduce the remaining measures over the coming months.

The agency is wholly owned by HM Treasury and is responsible for managing the government's commercial interests in a range of businesses. It previously played a central role in overseeing the state's holdings in Royal Bank of Scotland and Lloyds following the 2008 financial crisis.

Public sector cyber resilience

The disclosure comes amid growing scrutiny of cybersecurity across public bodies, as organisations face increasing pressure to protect sensitive information from both conventional cybercriminals and emerging AI-enabled threats.

Security experts have warned that advances in AI could allow attackers to identify exposed data, automate reconnaissance and exploit security weaknesses more rapidly than before.

The UKGI incident is likely to renew calls for stricter governance around the handling of internal government information, particularly where human error remains a significant cause of data exposure.

Concerns over emerging cyber risks have intensified following recent disclosures involving AI.

Last month, OpenAI said an autonomous AI agent had located and used exposed login credentials to gain access to several publicly available online services, illustrating how automated systems could accelerate the exploitation of existing security weaknesses.