[Blog](/blog)

Show links

Resources

[Blog](/blog)

[Breaches](/breaches)

[eBooks, reports, & more](/resources)

[Events](/events)

[News](/news)

[Cybersecurity](/category/cybersecurity)

Show links

Categories

[Attack Surface Management](/category/attack-surface-management)

[Company News](/category/company-news)

[Compliance and Regulations](/category/compliance-and-regulations)

[Cybersecurity](/category/cybersecurity)

[Data Breaches](/category/data-breaches)

[DevOps](/category/devops)

[Human Cyber Risk](/category/human-cyber-risk)

[Risks and Vulnerabilities](/category/risks-and-vulnerabilities)

[Third-Party Risk Management](/category/third-party-risk-management)

[Vendor Risk Management](/category/vendor-risk-management)

[Biggest Data Breaches in the UK (Updated July 2026)](/blog/biggest-data-breaches-uk)

Publish date

August 5, 2026

{x} minute read

# Biggest Data Breaches in the UK (Updated July 2026)

[Get a demo](/contact-sales)

[Free trial](/demo)

[Download the PDF guide](/resources/complete-guide-to-data-breaches)

[Free trial](/demo)

Written by

[Kyle Chin](/team/kyle-chin)

Cybersecurity Writer

Kyle's work has been featured in law publications, academic institutions, and government bodies.

Reviewed by

[Kaushik Sen](/team/kaushik-sen)

Chief Marketing Officer

Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education.

Table of contents

eBook

A Complete Guide to Data Breaches

Free resource

### A Complete Guide to Data Breaches

Learn how to avoid a costly data breach with a comprehensive prevention strategy.

[Download now](/resources/complete-guide-to-data-breaches)

This is a ranked guide to the 26 largest and most consequential data breaches affecting UK organizations or residents, current as of July 2026. Entries are ordered primarily by the number of records or individuals affected, with several high-notability incidents included regardless of scale because their impact on safety, national security, or public trust was severe. Where figures are disputed, estimated, or claimed only by attackers, we flag them as such.

For each incident you'll find the records affected, key dates, sector, attack vector, data exposed, and the regulatory aftermath, with a source link. One pattern runs through the most damaging recent cases: the biggest UK breaches of the past two years rarely started at the headline organization. They started with a supplier, a contractor, or an outsourced help desk.

## UK regulatory and statistical context

Breaches at this scale sit on top of a steady baseline of attacks against UK organizations. The [Cyber Security Breaches Survey 2025/2026](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026) found that 43% of UK businesses and 28% of charities identified a breach or attack in the prior 12 months, equating to roughly 612,000 businesses and 57,000 charities.

A few figures from that data set frame everything below:

* **Phishing is still the dominant entry point**, reported by 38% of businesses and 25% of charities.
* **Supply-chain oversight remains thin.** Only 15% of businesses formally review the cyber risk of their immediate suppliers, falling to 6% for the wider supply chain.
* **Incidents are getting more damaging.** The share of breaches leading to lost revenue or share value more than doubled, from 2% to 5%.
* **Most organizations are unprepared to respond.** Just 25% of businesses have a formal incident response plan.

Enforcement is tightening in parallel. The Information Commissioner's Office has shifted toward fewer but heavier penalties, exemplified by the [£14 million combined fine against Capita](https://www.cpomagazine.com/cyber-security/ico-fines-capita-14-million-over-data-breach-that-exposed-the-personal-information-of-6-million-people/) in October 2025, one of the largest UK security-failure fines on record.

## 26 biggest data breaches in the UK

The list runs from the largest exposures by records to lower-count incidents that earned their place through the sensitivity of the data or the safety consequences for the people involved. These [UK data breach statistics](https://www.upguard.com/blog/data-breach-statistics) reflect the current public record, including revised numbers where organizations updated their initial estimates.

### 1. UK Electoral Commission

**Records affected:** Approximately 40 million registered voters (electoral registers 2014 to 2022, plus around 100,000 people on the overseas and open registers)\
**Date of breach:** Initial access August 2021 (undetected for roughly 14 months)\
**Date disclosed:** August 2023\
**Sector:** Government / electoral administration\
**Attack vector:** Exploitation of unpatched Microsoft Exchange servers, followed by persistent access to email and file servers\
**Data exposed:** Names, home addresses, email addresses, and the contents of the Commission's email system

Hostile actors sat inside the Electoral Commission's systems for more than a year before detection in October 2022, and because the Commission held copies of the full electoral registers, the personal data of essentially every registered voter across an eight-year window was accessible. In March 2024 the UK Government attributed the intrusion to a China state-affiliated actor, framing it as espionage rather than criminal data theft.

**Aftermath:** The ICO issued a formal reprimand in July 2024 rather than a fine, concluding the Commission had failed to keep servers patched and had not enforced adequate password policies, while noting no evidence the data had been misused.

**Source:** [Computer Weekly: Basic failures led to hack of Electoral Commission data on 40 million people](https://www.computerweekly.com/news/366599512/Basic-failures-led-to-hack-of-Electoral-Commission-data-on-40-million-people)

### 2. Equifax (UK operations)

**Records affected:** 13.8 million UK consumers (revised upward from an initial estimate of 400,000)\
**Date of breach:** May to July 2017\
**Date disclosed:** September 2017, with the full UK figure confirmed October 2017\
**Sector:** Financial services / credit reference\
**Attack vector:** Exploitation of an unpatched Apache Struts vulnerability in Equifax's US dispute portal, where UK data had been processed\
**Data exposed:** Names, dates of birth, telephone numbers, partial card numbers, and in some cases addresses, usernames, passwords, and security questions and answers

The 2017 Equifax breach is remembered as a US event, but UK data had been routed through the compromised US environment, exposing 13.8 million British consumers. The ICO found that the UK arm had failed to ensure its US parent was adequately protecting UK consumer data, making it one of the clearest precedents among UK [financial services data breaches](https://www.upguard.com/blog/biggest-data-breaches-financial-services) on accountability for data processed offshore.

**Aftermath:** The ICO fined Equifax Ltd £500,000 in September 2018, the pre-GDPR maximum, and the Financial Conduct Authority separately fined it £11,164,400 in October 2023 for its handling of the incident.

**Source:** [FCA: Equifax Ltd fined for cyber security breach](https://www.fca.org.uk/news/press-releases/equifax-ltd-fine-cyber-security-breach)

### 3. Dixons Carphone

**Records affected:** 5.6 million payment cards and approximately 14 million personal data records (revised sharply upward from an initial estimate of 1.2 million)\
**Date of breach:** July 2017 to April 2018\
**Date disclosed:** June 2018, revised upward July 2018\
**Sector:** Retail\
**Attack vector:** Point-of-sale malware installed on 5,390 tills, harvesting card data as it was processed\
**Data exposed:** Payment card data, names, postal and email addresses, and failed credit checks

Attackers ran card-scraping malware across thousands of Dixons Carphone tills for nine months without detection, and the initial disclosure dramatically understated the scope, with the personal-record figure revised from 1.2 million to around 14 million weeks later. The ICO found systemic failures including poor network segregation, absent patching, and a lack of local firewalls.

**Aftermath:** The ICO fined DSG Retail Ltd £500,000 in January 2020, again the Data Protection Act 1998 maximum because the conduct predated GDPR, following a separate £400,000 fine against Carphone Warehouse in 2018.

**Source:** [Computer Weekly: Retail group Dixons Carphone fined £500,000 over data breach](https://www.computerweekly.com/news/252476523/Retail-group-Dixons-Carphone-fined-500000-over-data-breach)

### 4. easyJet

**Records affected:** 9 million customers, including 2,208 with credit card details exposed\
**Date of breach:** January 2020 (with unauthorized access reported from October 2019)\
**Date disclosed:** May 2020\
**Sector:** Aviation\
**Attack vector:** Not publicly confirmed; described by easyJet as a "highly sophisticated" intrusion\
**Data exposed:** Email addresses and travel itinerary details for 9 million customers; full credit card numbers and CVV codes for 2,208 customers

easyJet disclosed the breach roughly four months after discovery, drawing criticism for the delay. Travel itinerary data is unusually sensitive because it reveals movement patterns, and the exposure of full card numbers including CVV for a subset of customers made the incident materially worse than a simple contact-data leak.

**Aftermath:** A group claim was brought in the High Court on behalf of affected passengers. The ICO investigated but has not published a monetary penalty.

**Source:** [Computer Weekly: Nine million easyJet customer details lost in data breach](https://www.computerweekly.com/news/252483339/Nine-million-EasyJet-customer-details-lost-in-data-breach)

### 5. 23andMe

**Records affected:** Approximately 6.9 million users globally, of whom 155,592 were UK residents; around 14,000 accounts were directly compromised\
**Date of breach:** April to September 2023\
**Date disclosed:** October 2023\
**Sector:** Consumer genomics / health\
**Attack vector:** Credential stuffing against accounts with reused passwords and no mandatory multi-factor authentication, then mass scraping via the DNA Relatives feature\
**Data exposed:** Names, dates of birth, profile photos, geographic location, ancestry and ethnicity estimates, health-related genetic reports, and family relationship data

Attackers logged into roughly 14,000 accounts using credentials leaked elsewhere, then exploited the opt-in DNA Relatives feature to pull profile data on millions of linked users. Datasets specifically targeting Ashkenazi Jewish and Chinese users were advertised on criminal forums, giving the incident an explicit ethnic-targeting dimension.

**Aftermath:** The ICO fined 23andMe £2.31 million in June 2025, citing inadequate authentication and incident response. The company filed for Chapter 11 bankruptcy in March 2025, raising questions about the custody of affected UK users' genetic data.

**Source:** [The Register: 23andMe hit with £2.3M fine after exposing genetic data](https://www.theregister.com/2025/06/17/23andme_ico_fine/)

### 6. Capita

**Records affected:** Approximately 6.6 million individuals, including special category data\
**Date of breach:** March 2023\
**Date disclosed:** March 2023, with scope revised repeatedly through 2023\
**Sector:** Outsourcing / business process services\
**Attack vector:** Malware delivered to an employee device, escalated to domain-level access; a separate unsecured storage bucket also exposed benefits data\
**Data exposed:** Names, contact details, National Insurance numbers, bank details, pension records, and special category data including health and criminal record data

Capita detected suspicious activity but took nearly a week to remove the intruder, during which data on millions of people was exfiltrated. Because Capita administers pension schemes and public-sector contracts, the fallout spread across the Universities Superannuation Scheme, dozens of local authorities, and multiple NHS bodies.

**Aftermath:** In October 2025 the ICO fined Capita plc and Capita Pension Solutions Ltd a combined £14 million, reduced from a provisional figure reported at around £45 million after remediation and cooperation were taken into account.

**Source:** [CPO Magazine: ICO fines Capita £14 million over data breach affecting 6 million people](https://www.cpomagazine.com/cyber-security/ico-fines-capita-14-million-over-data-breach-that-exposed-the-personal-information-of-6-million-people/)

### 7. Co-op Group

**Records affected:** Personal data of all 6.5 million Co-op members\
**Date of breach:** Late April 2025\
**Date disclosed:** April 2025; full member-data impact admitted May 2025\
**Sector:** Retail / grocery / funeralcare\
**Attack vector:** Social engineering of IT helpdesk staff to reset credentials and bypass multi-factor authentication, attributed to the Scattered Spider ecosystem\
**Data exposed:** Member names, contact details, and dates of birth; Co-op stated no financial, payment, or password data was taken

Co-op initially described the incident as an attempted intrusion, then confirmed within two weeks that attackers had copied the data of every one of its 6.5 million members. The group pre-emptively shut down large parts of its IT estate, which caused significant stock shortages across its convenience-store network for weeks.

**Aftermath:** Co-op reported a revenue impact of around £206 million for the first half of 2025. The National Crime Agency arrested four people in July 2025 in connection with the Co-op, M\&S, and Harrods intrusions, and the ICO opened an investigation.

**Source:** [Computer Weekly: Co-op declares cyber attack damage cost £206m](https://www.computerweekly.com/news/366632018/Co-op-declares-cyber-attack-damage-cost-it-206m)

### 8. Marriott International (UK enforcement)

**Records affected:** Approximately 339 million guest records globally, of which around 7 million related to UK residents\
**Date of breach:** 2014 (Starwood systems) to September 2018\
**Date disclosed:** November 2018\
**Sector:** Hospitality\
**Attack vector:** Compromise of the Starwood reservation database prior to Marriott's 2016 acquisition, undetected through the integration; widely attributed to a Chinese state-linked actor\
**Data exposed:** Names, addresses, phone numbers, email addresses, passport numbers, arrival and departure dates, and encrypted payment card data

Attackers were inside the Starwood reservation environment for four years, spanning Marriott's acquisition, so Marriott inherited an active compromise it did not identify during due diligence. Around 5.25 million unencrypted passport numbers were among the exposed records, and it sits alongside the [biggest data breaches worldwide](https://www.upguard.com/blog/biggest-data-breaches) as the standard reference for cyber due diligence in mergers and acquisitions.

**Aftermath:** The ICO fined Marriott £18.4 million in October 2020, sharply reduced from a £99.2 million notice of intent, citing remediation and the economic impact of COVID-19.

**Source:** [Hunton: ICO fines Marriott International £18.4 million for security breach](https://www.hunton.com/privacy-and-cybersecurity-law-blog/ico-fines-marriott-international-18-4-million-for-security-breach)

### 9. Companies House WebFiling

**Records affected:** Approximately 5 million registered companies, and by extension the personal data of their directors and officers (the number of individuals actually accessed has not been published)\
**Date of breach:** Vulnerability introduced October 2025; live for roughly five months until March 2026\
**Date disclosed:** March 2026\
**Sector:** Government / corporate registry\
**Attack vector:** A logic and session-handling flaw; a user with any valid Companies House login could select "File for another company", enter any company number, press the browser back button four times, and view the target company's dashboard using only their own ordinary login\
**Data exposed:** Company officers' residential (home) addresses, email addresses, and dates of birth, including data suppressed from the public register

The exploit required no tooling, no technical skill, and no credentials beyond an ordinary free Companies House account. Residential address suppression is a statutory protection used by people at risk of harassment, stalking, or violence, so exposing that field carries direct physical safety consequences rather than only fraud risk.

**Aftermath:** Companies House suspended the WebFiling service and self-reported to both the ICO and the National Cyber Security Centre. As of late July 2026 no penalty had been published and no figure released for how many records were actually accessed during the five-month window.

**Source:** [Help Net Security: Companies House data exposure](https://www.helpnetsecurity.com/2026/03/17/companies-house-webfiling-service-vulnerability/)

### 10. Uber (UK enforcement)

**Records affected:** 2.7 million UK riders and 82,000 UK drivers (part of 57 million global records)\
**Date of breach:** October to November 2016\
**Date disclosed:** November 2017 (concealed for over a year)\
**Sector:** Transport / gig economy\
**Attack vector:** Credentials found in a private code repository used to access an Uber cloud storage environment\
**Data exposed:** Names, email addresses, mobile phone numbers, and for drivers, journey and earnings data

Uber paid the attackers $100,000 through its bug bounty program and required them to sign non-disclosure agreements, concealing the breach for more than a year rather than notifying regulators or users. The cover-up, not the intrusion, is what makes this case a landmark, and it reshaped how the [largest US data breaches](https://www.upguard.com/blog/biggest-data-breaches-us) involving concealment are prosecuted.

**Aftermath:** The ICO fined Uber £385,000 in November 2018. The company's former chief security officer was convicted in a US federal court in October 2022, the first criminal conviction of a security executive for breach concealment.

**Source:** [Computer Weekly: ICO fines Uber £385,000 for data protection failings](https://www.computerweekly.com/news/252453244/ICO-fines-Uber-385000-for-data-protection-failings)

### 11. Synnovis (NHS pathology services)

**Records affected:** Approximately 900,000 patients identified in the published dataset (estimated; Synnovis and NHS England have not published a final confirmed figure)\
**Date of breach:** June 2024\
**Date disclosed:** June 2024, with patient death confirmed June 2025\
**Sector:** Healthcare / pathology\
**Attack vector:** Qilin ransomware, with initial access reported as via compromised credentials\
**Data exposed:** Patient names, NHS numbers, dates of birth, test descriptions and results, and in some records data relating to sexually transmitted infections and cancer diagnoses

The Qilin attack crippled pathology services across major south-east London hospitals, forcing the postponement of more than 10,000 outpatient appointments and over 1,700 elective procedures, and triggering a national appeal for O-type blood. Around 400GB of data was published to a criminal leak site, ranking it among the most severe [healthcare data breaches](https://www.upguard.com/blog/biggest-data-breaches-in-healthcare) on record.

**Aftermath:** In June 2025 a hospital trust confirmed one patient's death was partly attributed to a delayed blood test result caused by the attack, the first publicly confirmed UK death linked to a cyber attack. The ICO opened an investigation into Synnovis.

**Source:** [The Register: Qilin ransomware attack on NHS supplier contributed to patient fatality](https://www.theregister.com/2025/06/26/qilin_ransomware_nhs_death/)

### 12. Virgin Media

**Records affected:** 900,000 customers and potential customers\
**Date of breach:** Database left unsecured from April 2019; accessed at least once by an unauthorized party\
**Date disclosed:** March 2020\
**Sector:** Telecommunications / media\
**Attack vector:** Misconfiguration; a marketing database was left accessible without password protection for around ten months\
**Data exposed:** Names, home and email addresses, phone numbers, and in a small number of cases requests to block or unblock adult, gore, and gambling websites

This was not a hack but a configuration failure: a marketing database sat on the open internet for ten months and was accessed by at least one unauthorized third party. The inclusion of website-blocking preference data made a subset of records unusually sensitive.

**Aftermath:** The ICO investigated and no monetary penalty was published. A group claim was filed in the High Court seeking damages for distress on behalf of affected customers.

**Source:** [Computer Weekly: Virgin Media confirms misconfigured database left personal data of 900,000 people exposed](https://www.computerweekly.com/news/252479642/Virgin-Media-confirms-misconfigured-database-left-personal-data-of-900000-people-exposed)

### 13. Harrods

**Records affected:** Approximately 430,000 customer records\
**Date of breach:** Attempted intrusion detected May 2025; a separate third-party compromise disclosed September 2025\
**Date disclosed:** May 2025 (initial), September 2025 (customer data confirmed)\
**Sector:** Luxury retail\
**Attack vector:** Initial attempt via the Scattered Spider-linked social engineering wave that struck M\&S and Co-op; the September disclosure involved a compromise at a third-party service provider\
**Data exposed:** Names and basic contact details for around 430,000 customers; Harrods stated no payment or account password data was taken

Harrods was the third major UK retailer hit in the spring 2025 Scattered Spider campaign, initially reporting that it had contained the attempt. In September 2025 it disclosed a separate incident at a third-party provider, and because the customer base skews high net worth, even name-and-contact data carries elevated targeted fraud and physical-security risk.

**Aftermath:** Harrods declined to engage with the extortion attempt. Four arrests were made by the NCA in July 2025 across the M\&S, Co-op, and Harrods investigations, and the ICO was notified.

**Source:** [The Register: Harrods blames supplier after crims steal 430k customers' data](https://www.theregister.com/2025/09/29/harrods_blames_thirdparty_supplier_after)

### 14. British Airways

**Records affected:** 429,612 customers and staff, including 244,000 with card details and around 77,000 with CVV numbers\
**Date of breach:** June to September 2018\
**Date disclosed:** September 2018\
**Sector:** Aviation\
**Attack vector:** Magecart-style skimming; malicious code injected into the BA website and app payment flow after the attacker gained access via compromised credentials for a supplier employee, with no multi-factor authentication in place\
**Data exposed:** Names, addresses, email addresses, payment card numbers, expiry dates, and CVV codes

Attackers redirected customer payment data to a lookalike domain in real time for over two months, harvesting complete card details including CVV, the most directly monetizable form of payment data. The ICO found BA had no adequate justification for the absence of multi-factor authentication or file integrity monitoring, making it the reference case for supply-chain-enabled web skimming in the UK.

**Aftermath:** The ICO fined BA £20 million in October 2020, down from a record £183.39 million notice of intent. A group action on behalf of more than 16,000 claimants was settled in July 2021 on confidential terms.

**Source:** [Pinsent Masons: British Airways fined £20m over GDPR breach](https://www.pinsentmasons.com/out-law/news/british-airways-fined-20m-over-gdpr-breach)

### 15. Shared Services Connected Ltd and Ministry of Defence payroll

**Records affected:** Approximately 272,000 serving armed forces personnel and veterans\
**Date of breach:** Detected early May 2024\
**Date disclosed:** May 2024\
**Sector:** Defence / government outsourcing\
**Attack vector:** Compromise of a third-party payroll system operated by contractor SSCL; the Government did not formally attribute the attack, though ministers pointed to a state actor and reporting linked it to China\
**Data exposed:** Names, bank account details, and in a small number of cases personal addresses of current and former military personnel

An external payroll contractor holding the banking details of the majority of the UK's serving military was compromised, exposing data with obvious value for both financial fraud and foreign intelligence targeting. The then Defence Secretary told Parliament that a malign actor was suspected and that the system had been taken offline.

**Aftermath:** The Ministry of Defence stood up an eight-point response plan including personal data monitoring for affected personnel. The ICO was notified, and no monetary penalty against SSCL had been published as of July 2026.

**Source:** [AP via Global News: UK payroll data breach exposed details of 272,000 military personnel](https://globalnews.ca/news/10479985/britain-defence-ministry-data-breach)

### 16. Legal Aid Agency

**Records affected:** Approximately 2.1 million individual pieces of data relating to legal aid applicants, covering applications from 2010 onward\
**Date of breach:** April 2025\
**Date disclosed:** May 2025\
**Sector:** Government / justice\
**Attack vector:** Not fully disclosed; the Ministry of Justice confirmed a cyber attack on the Legal Aid Agency's digital services with data downloaded by the attackers\
**Data exposed:** Names, addresses, dates of birth, National Insurance numbers, criminal history, employment status, and financial data including debts, contributions, and payments

This is arguably the most sensitive UK government breach by content rather than volume. Legal aid records combine criminal history with financial hardship data and information about people involved in domestic abuse, family court, and immigration proceedings, so exposure can directly endanger people fleeing violence.

**Aftermath:** The Ministry of Justice took the digital application service offline and told applicants to assume their data had been taken, causing significant disruption to the justice system. As of July 2026 no ICO penalty had been published.

**Source:** [Computer Weekly: Legal Aid Agency breach may encompass millions of people](https://www.computerweekly.com/news/366623844/Legal-Aid-Agency-breach-may-encompass-millions-of-people)

### 17. Ticketmaster UK

**Records affected:** Approximately 1.5 million UK customers (around 9.4 million across Europe); approximately 60,000 Barclaycard payment cards subject to known fraud\
**Date of breach:** February to June 2018\
**Date disclosed:** June 2018\
**Sector:** Ticketing / entertainment\
**Attack vector:** Magecart compromise of a third-party JavaScript chatbot supplied by Inbenta, which Ticketmaster had deployed on its payment pages contrary to the supplier's intended use\
**Data exposed:** Names, addresses, email addresses, telephone numbers, payment card numbers, and CVV numbers

Ticketmaster embedded a supplier's customer-support chatbot script directly into its payment pages, and when the supplier was compromised the script began skimming live card data. Barclaycard flagged a fraud pattern in April 2018, but Ticketmaster took a further nine weeks to identify the source.

**Aftermath:** The ICO fined Ticketmaster UK Ltd £1.25 million in November 2020. Around 60,000 Barclaycard customers were victims of known fraud, and a group claim was brought on behalf of affected customers.

**Source:** [Computer Weekly: Ticketmaster fined £1.25m by ICO](https://www.computerweekly.com/news/252492047/Ticketmaster-fined-125m-by-ICO-for-failing-to-protect-customer-data)

### 18. Marks and Spencer

**Records affected:** Number not disclosed; M\&S confirmed personal data of an unspecified portion of its customer base (the number affected has never been confirmed and should not be equated to the total customer base)\
**Date of breach:** Initial access reported as February 2025, with disruption from April 2025\
**Date disclosed:** April 2025; customer data theft confirmed May 2025\
**Sector:** Retail\
**Attack vector:** Social engineering of a third-party IT service desk to obtain credential resets, attributed to Scattered Spider, followed by DragonForce ransomware deployment\
**Data exposed:** Names, dates of birth, home and email addresses, phone numbers, order history, and masked payment card digits; M\&S stated no usable payment card details and no account passwords were taken

M\&S suspended online ordering entirely for around six weeks, one of the longest e-commerce outages ever suffered by a major UK retailer. The attackers used help-desk impersonation rather than a technical exploit, which shifted the board-level conversation toward identity verification and outsourced IT support as the primary risk surface.

**Aftermath:** M\&S estimated a roughly £300 million hit to 2025/26 operating profit before mitigation (which includes insurance and cost actions). The NCA arrested four people in July 2025, the ICO opened an investigation, and the incident fed into the UK Cyber Security and Resilience Bill debate.

**Source:** [CNBC: M\&S cyberattack to wipe out nearly one-third of annual profits](https://www.cnbc.com/2025/05/21/ms-cyberattack-to-wipe-out-nearly-one-third-of-annual-profits.html)

### 19. Ministry of Defence Afghan relocation dataset leak

**Records affected:** A spreadsheet containing the details of 18,714 Afghan Relocations and Assistance Policy (ARAP) applicants; reporting cites figures of up to around 100,000 people when family members are counted (estimated and disputed)\
**Date of breach:** February 2022 (spreadsheet emailed outside authorized government systems in error)\
**Date disclosed:** Data surfaced online August 2023; publicly disclosed July 2025 when the superinjunction was lifted\
**Sector:** Defence / government\
**Attack vector:** Human error; a Defence official emailed a dataset believing it contained only a small extract, when hidden rows contained the full applicant list\
**Data exposed:** Names, contact details, family member details, and application information for Afghans who had worked with or supported UK forces

A single mis-sent spreadsheet exposed the identities of Afghans who had assisted British forces, a group facing direct Taliban reprisal risk. The Ministry of Defence obtained a superinjunction in September 2023 that barred reporting of the breach and of the order itself, and it held for nearly two years.

**Aftermath:** The Government announced a compensation scheme, while separate group litigation could run far higher. Note that the ICO's £350,000 fine against the Ministry of Defence relates to a separate September 2021 incident in which ARAP email addresses were exposed in a mass email, not to the February 2022 spreadsheet leak.

**Source:** [Forces News: MOD faces first legal claim over Afghan data breach](https://www.forcesnews.com/operations/afghanistan/mod-faces-first-legal-claim-over-data-breach-leaked-details-thousands-risk)

### 20. British Library

**Records affected:** Approximately 490,000 files, around 600GB of data, including internal HR and employee records; a subset of user data was also affected\
**Date of breach:** October 2023\
**Date disclosed:** October 2023, with data-leak confirmation November 2023\
**Sector:** Culture / national institution\
**Attack vector:** Rhysida ransomware; the likely entry point was compromised credentials on a terminal services server without multi-factor authentication\
**Data exposed:** Employee personal data including HR records, plus internal documents; user data was among the leaked files

Rhysida encrypted and exfiltrated data, then ultimately dumped roughly 600GB when the Library refused to pay. What makes this the most instructive UK ransomware case is the Library's decision to publish a detailed public lessons-learned report in March 2024, citing legacy infrastructure and a highly customized on-premise estate as reasons recovery was so slow.

**Aftermath:** The Library estimated recovery costs of around £6 million to £7 million, drawn largely from its own reserves. No ICO penalty was issued, and its published cyber incident review became recommended reading across the UK public sector.

**Source:** [British Library: Learning lessons from the cyber-attack](https://www.bl.uk/home/british-library-cyber-incident-review-8-march-2024.pdf)

### 21. TalkTalk

**Records affected:** 156,959 customers, including 15,656 with bank account numbers and sort codes\
**Date of breach:** October 2015\
**Date disclosed:** October 2015\
**Sector:** Telecommunications\
**Attack vector:** SQL injection against three legacy webpages inherited from TalkTalk's 2009 acquisition of Tiscali, running an outdated database version with a known, patchable vulnerability\
**Data exposed:** Names, addresses, dates of birth, email addresses, phone numbers, account information, and bank account details and sort codes for a subset

The attack used a basic injection technique against pages TalkTalk did not know it still had, exploiting a vulnerability for which a fix had been available for more than three years. TalkTalk's chaotic public communications became a case study in how not to handle breach disclosure.

**Aftermath:** The ICO fined TalkTalk £400,000 in October 2016, at the time the largest fine the regulator had ever issued, followed by a separate £100,000 fine in 2017. TalkTalk reported around £42 million in costs and lost more than 100,000 customers.

**Source:** [Pinsent Masons: Record £400,000 fine for TalkTalk following data breach](https://www.pinsentmasons.com/out-law/news/record-400000-fine-for-talktalk-following-data-breach)

### 22. Interserve

**Records affected:** 113,000 current and former employees\
**Date of breach:** March to May 2020\
**Date disclosed:** May 2020\
**Sector:** Construction / outsourcing\
**Attack vector:** A phishing email opened by an employee installed malware; the endpoint protection tool quarantined it and raised an alert that Interserve failed to investigate, allowing the attacker to move laterally, encrypt 283 systems, and exfiltrate data\
**Data exposed:** Names, contact details, National Insurance numbers, bank account details, and special category data including ethnic origin, religion, disability, sexual orientation, and health information

The technical control worked, and the organization ignored it: Interserve's anti-virus flagged and quarantined the malware, but nobody followed up on the alert, and the attacker returned to complete the compromise. The ICO also found outdated software, unsupported operating systems, and inadequate staff training.

**Aftermath:** The ICO fined Interserve Group Ltd £4.4 million in October 2022, one of its largest security-failure penalties, pairing the announcement with a public warning about ignoring alerts and running unsupported software.

**Source:** [CSO Online: UK ICO fines Interserve £4.4 million](https://www.csoonline.com/article/573941/uk-ico-fines-interserve-4-4-million-over-cyberattack-that-exposed-up-to-113-000-employees.html)

### 23. Advanced Computer Software Group

**Records affected:** 79,404 people (final ICO figure, revised down from an initial 82,946), including 890 people receiving home care\
**Date of breach:** August 2022\
**Date disclosed:** August 2022\
**Sector:** Health and social care software / NHS supplier\
**Attack vector:** LockBit ransomware; initial access via a customer account on a Citrix server that lacked multi-factor authentication\
**Data exposed:** Phone numbers, medical records, and for 890 people receiving care at home, details of how to gain entry to their homes

Advanced's systems underpin NHS 111 triage, out-of-hours GP services, and mental health records. When LockBit took them down, NHS 111 fell back to pen and paper for weeks, and the exposure of home-entry information for 890 vulnerable people receiving domiciliary care is among the most alarming data categories in any UK breach.

**Aftermath:** The ICO fined Advanced Computer Software Group Ltd £3,076,320 in March 2025, reduced from a provisional £6.09 million through a voluntary settlement, framing the case as a warning about multi-factor authentication gaps in critical health supply chains.

**Source:** [The Register: ICO fines NHS software supplier £3M for ransomware failings](https://www.theregister.com/2025/03/27/ransomwared_nhs_software_supplier_nabs)

### 24. Jaguar Land Rover

**Records affected:** Not disclosed; JLR confirmed that "some data" was affected. Record count remains unconfirmed\
**Date of breach:** August to September 2025\
**Date disclosed:** September 2025, with data impact confirmed September 2025\
**Sector:** Automotive manufacturing\
**Attack vector:** Not formally confirmed; claims of responsibility were made by a group associated with the Scattered Spider and ShinyHunters ecosystems\
**Data exposed:** JLR stated that some data had been affected and notified those concerned; the company has not published a breakdown

JLR shut down its global IT estate to contain the attack, halting vehicle production for roughly five weeks and cascading through a supplier base employing tens of thousands of people. The Cyber Monitoring Centre modelled the total UK economic impact at around £1.9 billion (a range of £1.6 billion to £2.1 billion), making it, on that assessment, the single most financially damaging cyber event in British history.

**Aftermath:** The UK Government provided a £1.5 billion loan guarantee to support JLR's supply chain, an unprecedented state intervention in response to a cyber incident. The ICO was notified, and the incident became a central exhibit in the case for the UK Cyber Security and Resilience Bill.

**Source:** [Cyber Monitoring Centre: Statement on the Jaguar Land Rover cyber incident](https://cybermonitoringcentre.com/2025/10/22/cyber-monitoring-centre-statement-on-the-jaguar-land-rovercyber-incident-october-2025/)

### 25. Kido International

**Records affected:** Reported as around 8,000 children's profiles\
**Date of breach:** September 2025\
**Date disclosed:** September 2025\
**Sector:** Childcare / education\
**Attack vector:** Not fully disclosed; an extortion group calling itself Radiant claimed the attack and published stolen data\
**Data exposed:** Children's names, photographs, dates of birth, addresses, safeguarding notes, and parent and guardian contact details

Attackers stole records from a London nursery group and published photographs and personal details of individual children on a leak site, then directly contacted parents to pressure the company into paying. This was the most explicit case yet of extortionists weaponizing children's data for leverage.

**Aftermath:** The Metropolitan Police made arrests in connection with the incident, and the attackers later claimed to have deleted the data. The ICO opened an investigation and issued sector-wide guidance to nurseries and schools.

**Source:** [Malwarebytes: Hackers threaten parents to get nursery to pay ransom](https://www.malwarebytes.com/blog/news/2025/09/hackers-threaten-parents-get-nursery-to-pay-ransom-or-we-leak-your-childs-data)

### 26. Cabinet Office New Year Honours list

**Records affected:** 1,097 people\
**Date of breach:** December 2019\
**Date disclosed:** December 2019\
**Sector:** Government\
**Attack vector:** Human error in a new automated process; a file containing home addresses was published on GOV.UK in error and remained accessible for over two hours, receiving 3,872 views\
**Data exposed:** Names and unredacted home addresses of New Year Honours recipients

The Cabinet Office published the honours list with a column of home addresses left in, exposing the residential addresses of more than a thousand recipients including senior police officers, counter-terrorism officials, and people who had received honours for work in sensitive fields. Some recipients reported abusive or threatening contact afterward.

**Aftermath:** The ICO fined the Cabinet Office £500,000 in December 2021, later reduced to £50,000 on appeal in 2022, which found the original penalty disproportionate. The case is now a leading UK authority on proportionality in public-sector data protection fines.

**Source:** [ICO Newsroom: ICO and Cabinet Office reach agreement on New Year Honours data breach fine](https://ico-newsroom.prgloo.com/news/ico-and-cabinet-office-reach-agreement-on-new-year-honours-data-breach-fine)

## What the biggest UK breaches have in common

Learning how to [prevent data breaches](https://www.upguard.com/blog/prevent-data-breaches) starts with reading this list top to bottom, where a pattern emerges: the heaviest recent UK incidents were not front-door break-ins. Synnovis, Advanced, Capita, SSCL, and Marks and Spencer were all third-party or supply-chain events, where the compromised organization was a supplier, contractor, or outsourced IT function rather than the brand in the headline.

The failure modes repeat across two decades of cases:

* **Unpatched known vulnerabilities:** the Electoral Commission, Equifax, and TalkTalk were breached through flaws that fixes already existed for.
* **Missing multi-factor authentication:** British Airways, Advanced, and the British Library each traced entry to an account or server without it.
* **Ignored alerts:** Interserve quarantined its malware and did nothing, and Capita's central criticism was the delay in acting on the first signal.
* **Help-desk social engineering:** Co-op and M\&S were compromised by attackers impersonating staff to reset credentials, not by a technical exploit.
* **Ordinary misconfiguration:** Virgin Media and the Cabinet Office exposed data with no attacker required.

Supply-chain exposure is the throughline, yet oversight has not caught up, and the practical work of [preventing third-party breaches](https://www.upguard.com/blog/prevent-third-party-data-breaches) still lags behind the risk. Continuous, outside-in monitoring of your own and your vendors' attack surface is what turns that blind spot into something you can act on before it becomes the next entry on a list like this.

## How UpGuard helps you monitor breach risk

Managing this kind of exposure means seeing your own attack surface and your vendors' at the same time, continuously rather than at a point in time. The UpGuard platform brings both together:

* [**Breach Risk**](https://www.upguard.com/product/breach-risk)**:** external [attack surface management](https://www.upguard.com/product/breach-risk/attack-surface-management) and threat intelligence that gives continuous, outside-in visibility of exposures across your attack surface, dark web, and brand impersonation, prioritizing findings by real exploitation likelihood rather than raw severity scores.
* [**Vendor Risk**](https://www.upguard.com/product/vendor-risk)**:** third-party and supply-chain risk management to assess, monitor, and engage the suppliers behind most large recent UK incidents, with the evidence you need for board and regulatory reporting.
* [**User Risk**](https://www.upguard.com/product/user-risk)**:** human risk management that discovers workforce threats like compromised credentials and Shadow AI, with in-workflow coaching that addresses the credential reuse and help-desk social engineering behind incidents like Co-op, Marks and Spencer, and 23andMe.

UpGuard is ranked [number one for third-party and supplier risk management on G2](https://www.upguard.com/g2). To see how continuous monitoring surfaces exposures before attackers do, [start a free trial](https://cyber-risk.upguard.com/register/trial).

## Frequently asked questions

### What is the largest data breach in the UK?

By records affected, the UK Electoral Commission breach is the largest, exposing the personal data of roughly 40 million registered voters over an eight-year window.

### What was the most recent major UK data breach?

The 2026 Companies House WebFiling exposure is among the most recent, potentially affecting about 5 million registered companies, while Jaguar Land Rover was the most economically damaging 2025 event at an assessed £1.9 billion.

### Which UK data breach was the most sensitive?

The Legal Aid Agency and Synnovis breaches rank highest by data sensitivity; the Synnovis attack was linked to the first UK patient death publicly attributed to a cyber attack.

### Have UK data breaches led to fines?

Yes. The ICO has issued significant penalties, including £20 million against British Airways, £18.4 million against Marriott, and a combined £14 million against Capita.

‍

eBook

A Complete Guide to Data Breaches

Free resource

### A Complete Guide to Data Breaches

Learn how to avoid a costly data breach with a comprehensive prevention strategy.

[Download now](/resources/complete-guide-to-data-breaches)

## Related posts

Learn more about the latest issues in cybersecurity.

Cybersecurity

#### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026)

A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news.

[](/team/revashni-moodley)

[Revashni Moodley](#)

October 14, 2026

Cybersecurity

#### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization)

Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us.

[](/team/revashni-moodley)

[Revashni Moodley](#)

August 25, 2026

Cybersecurity

#### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack)

Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook.

[](/team/nicholas-sollitto)

[Nicholas Sollitto](#)

June 1, 2026

Cybersecurity

#### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025)

Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here.

[](/team/revashni-moodley)

[Revashni Moodley](#)

October 14, 2026

Cybersecurity

#### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command)

Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more.

[](/team/revashni-moodley)

[Revashni Moodley](#)

December 1, 2025

Cybersecurity

#### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos)

Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap.

[](/team/phil-ross)

[Phil Ross](#)

September 3, 2026

[All posts](/blog)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](/contact-sales)

[Free trial](/demo)