Joint Investigation Launched into Prospect Trade Union Cyber Breach Affecting 160,000 Members A multi-jurisdictional investigation has been initiated by the UK’s Information Commissioner’s Office (ICO) and data protection authorities in Jersey, Guernsey, and the Isle of Man following a cyber incident in June 2025 that compromised the personal data of Prospect Custodian Trustees Ltd (Prospect), a trade union representing over 160,000 members—including scientists, engineers, and tech professionals. The breach exposed sensitive information, such as financial data, trade union membership details, ethnic origin, sexual orientation, disability status, and religious beliefs. The joint inquiry aims to assess the scope of the exposed data, potential harm to affected individuals, and Prospect’s compliance with data protection obligations, including: - Whether adequate technical and organizational safeguards were in place. - Whether breach notification requirements were met. - Whether appropriate mitigation steps were taken post-incident. The investigation reflects a coordinated effort to address cross-border cyber threats, with regulators emphasizing the need for collaborative enforcement to uphold data protection standards. John Edwards (UK ICO), Paul Vane (Jersey), Dr. Alexandra Delaney-Bhattacharya (Isle of Man), and Brent Homan (Guernsey) underscored the importance of accountability in handling sensitive personal data, particularly as cyberattacks increasingly target organizations operating across multiple jurisdictions. Each authority will examine Prospect’s compliance with its respective data protection laws. No further details will be released while the investigation is ongoing.