Skip to content

National Cyber Security Centre

The UK's national technical authority on cyber security, part of GCHQ, which advises government and industry and helps respond to major cyber incidents.

Current stories

securityConfirmed4 publishers

Legal Aid Agency traces records stolen in April 2025 breach back to 1978

UK Legal Aid Agency says about 250,000 records stolen in its April 2025 breach predate 2007, the oldest from 1978. The bulk of the data still falls between January 2007 and 16 May 2025, three years earlier than the 2010 start the agency confirmed in May.

Perspective Coverage

4 publishers
Builder
Builder 5%
Operator
Operator 74%
Investor
Investor 21%

Reality

Evidence68
Adoption
Not scored
Hype gap+5
Incentives45
Confidence74
scienceOne report1 publisher

NCSC's Chichester says state hackers now use AI at every stage of an attack on the UK

Paul Chichester, the NCSC's director of operations, says Russia, China, North Korea and Iran all use AI to attack the UK. New Scientist's report of the interview includes no attack counts, so the size of any rise in volume is unstated.

Publishers:newscientist.com

Reality

Evidence30
Adoption35
Hype gap+20
Incentives
Not scored
Confidence35
securityOne report1 publisher

UK ministers commit frontier AI to hunting flaws in government systems

UK AI minister Kanishka Narayan said on October 12 that government will use frontier AI to find flaws in its systems, after hackathons found over 400 flaws. The fix-time fall from 50 days to eight is credited to a central monitoring service.

Reality

Evidence35
Adoption25
Hype gap+30
Incentives55
Confidence55
securityOne report1 publisher

Seven governments pin a stolen-email portal on sanctioned Integrity Technology Group

The FBI and six other governments said on October 8 that hackers tied to Integrity Technology Group run a portal giving third parties access to stolen email. The firm, sanctioned by the US and UK, denies the accusations.

Reality

Evidence62
Adoption
Not scored
Hype gap+10
Incentives
Not scored
Confidence58
productConfirmed13 publishers

Extortion note meant for ASOS's IT team lands on customers' phones through the retailer's app

Apparent hackers sent an extortion note through ASOS's app to UK customers, claiming to have "fully compromised" its Snowflake instance. ASOS has not confirmed a breach, so the only compromise anyone has seen is that outsiders could message its app users.

Perspective Coverage

15 publishers
Builder
Builder 21%
Operator
Operator 55%
Investor
Investor 24%

Reality

Evidence74
Adoption
Not scored
Hype gap−15
Incentives66
Confidence70
securityOne report1 publisher

Most of a Labour MP's £2bn 'Putin Tax' floor rests on an assumed 10% cybercrime share

Labour MP Graeme Downie's report puts the yearly cost of Russian cyberattacks and sabotage to Britain at £2bn to £2.5bn, a figure it calls a floor. It arrives before a budget expected later this month, arguing the harm cannot be weighed against defence spending while government does not count it.

Publishers:therecord.media

Reality

Evidence30
Adoption
Not scored
Hype gap+35
Incentives60
Confidence40
leadershipOne report1 publisher

Hackers delivered their Asos extortion demand through the retailer's own app

Hackers used the Asos app on Tuesday to send UK users an extortion demand claiming they had compromised the retailer's Snowflake instance. Because the demand went to shoppers, the attackers decided when Asos had to speak to customers, before it could say what data, if any, was taken.

Publishers:bbc.co.uk

Reality

Evidence45
Adoption
Not scored
Hype gap+5
Incentives65
Confidence40
securityOne report1 publisher

ShinyHunters threatens to publish FBI agents' medical records unless the bureau retracts a May advisory

ShinyHunters claims it holds fitness-for-work medical records, including blood and urine results, on about 60,000 current and former FBI staff. Test results and home addresses cannot be reset like a password, so containment now depends on the files staying unpublished.

Publishers:bbc.com

Reality

Evidence45
Adoption
Not scored
Hype gap+20
Incentives65
Confidence50
buildOne report1 publisher

CHOSEN BRICK routes its commands through a Telegram bot issued per victim device

A joint NCSC, FBI and AIVD advisory traces the implant's exfiltration to Telegram and three object storage hosts. The same advisory tells defenders not to read traffic to those services as malicious on its own.

Publishers:dev.to

Reality

Evidence70
Adoption42
Hype gap−8
Incentives25
Confidence62
securityOne report1 publisher

Ninety-two percent of UK account-hack loss reports arrived after Report Fraud went live

City of London Police recorded a 417% rise in account-hack losses to £6.3m in the year to March. The arithmetic underneath it shows the average loss per victim halving as small cases got recorded for the first time.

Publishers:therecord.media

Reality

Evidence62
Adoption74
Hype gap+14
Incentives58
Confidence66
securityOne report1 publisher

The espionage quartermaster: China-nexus operators were buying scan and relay as a service

Lumen's Black Lotus Labs spent a year mapping a four-part framework sold to Chinese espionage operators. Its indicators belong to a supplier, so hunt the service rather than one group's habits.

Reality

Evidence52
Adoption58
Hype gap+18
Incentives66
Confidence48
productOne report1 publisher

The UK plant that went dark for four days was too small to have to tell anyone

The government confirmed the July outage and formally blamed nobody. The site sat below the level at which reporting cyber activity becomes a legal duty.

Publishers:thenextweb.com

Reality

Evidence55
Adoption62
Hype gap+24
Incentives66
Confidence52