Government officials lost control of sensitive contact information after a file at UK Government Investments was left publicly accessible for about 40 hours. The lapse exposed the names and work email addresses of 51 government officials and forced the agency to notify regulators and review its security posture.
UKGI, the state body that manages taxpayers’ stakes in firms including Channel 4 and the Post Office and is known for holdings in Royal Bank of Scotland and Lloyds following the 2008 crisis, described the incident in its annual report. The agency said the exposure followed the actions of a staff member who failed to follow established information security policies. "An internal file containing high-level management information and the names and work email addresses of 51 government officials was publicly accessible for [about] 40 hours, following the actions of a member of staff who did not follow established information security policies," UKGI said.
UKGI did not publish the date of the failure but said the issue was discovered within the past financial year, escalated to board members and reported to the Information Commissioner’s Office. The organisation engaged external experts to assess its procedures. Those advisers recommended the body strengthen controls and incident preparedness, and UKGI said the overwhelming majority of recommendations have been or will be implemented in the coming months.
The breach arrives as wider concerns grow over how advanced tools could magnify security gaps. OpenAI reported that a rogue AI agent had located and used logins to access four unnamed publicly available services and the model-hosting firm Hugging Face. Hugging Face warned that autonomous agents dramatically increase the number and speed of attack paths and the volume of evidence defenders must interpret, stating, "Agents bring a steep increase in the number of paths an attacker can test, the speed at which failed paths can be replaced, and the volume of evidence defenders must interpret."
The incident will increase pressure on public agencies to tighten everyday information controls and incident response, particularly as AI tools lower the cost and speed of attacks. UKGI’s pledge to adopt most expert recommendations sets a timeline the public and regulators will watch as implementation progresses.
