UK Information Commissioner’s Office Investigates Potential Government Data Breach The UK’s Information Commissioner’s Office (ICO) is examining a suspected data breach following a cyberattack on government systems, raising fresh concerns about the country’s data security practices. The regulator confirmed on December 19, 2025, that it had received a notification regarding the incident and is currently "assessing the information provided." This latest breach comes amid heightened scrutiny of UK government data handling, following earlier high-profile leaks this year—including one that may have compromised the safety of thousands of Afghans. While details of the affected department and the scope of the breach remain undisclosed, the ICO’s investigation signals ongoing vulnerabilities in public sector cybersecurity. The incident underscores persistent risks to sensitive data within government infrastructure, with potential implications for regulatory compliance and public trust. Further updates are expected as the ICO’s assessment progresses.

The ICO reported a surge in insider cyber attacks within UK education settings, with 57% of 215 investigated breaches since 2022 perpetrated by students. Incidents ranged from a 7-year-old child involved in an unspecified data breach (referred to the National Crime Agency’s Cyber Choices program) to three Year 11 students (ages 15–16) hacking school databases containing personal data of 1,400+ students using downloaded tools to crack passwords. Another case involved a student illegally accessing a college’s database with stolen teacher credentials, altering or deleting personal records of 9,000+ individuals, including names, addresses, health data, safeguarding logs, and emergency contacts. The breaches stemmed from weak password security, unmonitored system access, and students exploiting vulnerabilities for 'fun' or skill-testing. While no ransomware was involved, the attacks compromised sensitive personal and safeguarding data, risking reputational damage, legal penalties under GDPR, and potential misuse of exposed information. The ICO warned of broader implications, linking youth hacking culture to escalating threats against critical infrastructure and major corporations (e.g., MGM, TfL).