Foreign, Commonwealth and Development Office

Summary

The UK Foreign, Commonwealth and Development Office was hacked, with officials stating that thousands of documents were accessed and that the breach is under investigation. British officials have said they suspect Chinese state‑backed actors are responsible, though they have not made a formal attribution. They also noted that the risk to individuals appears low and that the vulnerability has been closed. The incident is part of a broader pattern of cyberattacks affecting UK organisations, including recent hits on Jaguar Land Rover and Marks & Spencer.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In October 2025 the UK Foreign Office experienced a cyber breach that was first reported by the Sun newspaper, which said a Beijing‑linked group had accessed thousands of documents. Trade Minister Chris Bryant confirmed the attack in broadcast interviews on Friday and stated that the loophole had been closed quickly. He said the risk to individuals was low. The UK government issued a statement saying it had been working to investigate the incident and that it takes the security of its systems and data extremely seriously. The incident had been under investigation since October.

The breach involved access to thousands of documents, and Bryant noted that the risk to individuals remained low. The hack occurred amid broader UK‑China tensions, including a cooling relationship linked to previous hacks, espionage and Beijing’s crackdown on democracy in Hong King. Earlier in 2025 UK firms Jaguar Land Rover and Marks Spencer had been hit by cyberattacks that halted key services, which Bryant referenced as part of modern life that must be tackled. Anonymous British officials said actors linked to the Chinese state were suspected of being behind the Foreign Office breach, but no formal attribution had been made at the time of the reports. The UK government was also deliberating on a proposed new Chinese Embassy in London, which would be the largest in Europe and would sit near the City financial centre and above sensitive fibre‑optic cables. Prime Minister Keir Starmer had criticized the conviction of Jimmy Lai and said he would travel to China on his first official visit as premier.

Bryant said the loophole was closed quickly after detection. The government continued to investigate the cyber incident. Officials reiterated that they take system security seriously. No further technical details about containment or remediation were disclosed in the reports. The incident was treated as one of several cyber threats the UK must address.

Sources

Sources available to members: 1 source.