UK state investment agency discloses 40-hour data exposure

UK Government Investments has disclosed that an internal file containing management information and the work contact details of 51 government officials was publicly accessible for about 40 hours.

The agency, which manages the British government’s interests in companies including Channel 4 and the Post Office, reported the incident in its annual report. It attributed the exposure to a staff member who did not follow established information-security policies.

UKGI did not specify the date of the incident, saying only that it occurred during the past financial year. The agency said the breach was escalated to its board and reported to the Information Commissioner’s Office, the United Kingdom’s data-protection regulator.

External specialists were brought in to review UKGI’s security arrangements and recommended stronger controls and incident preparedness. The agency said most of those recommendations had already been implemented or would be introduced in the coming months.

The disclosure establishes that the information was exposed, but the available report does not say that it was exploited or identify any resulting harm. UKGI described the affected personal information as names and work email addresses.