Government confirms cyber security incident contained following extensive security measures - 865/2026

HM Government of Gibraltar confirms that it has been responding to a cyber security incident affecting elements of its cloud-based IT environment.

The incident, which originated several weeks ago, involved unauthorised access to the Government's cloud environment, which includes services such as Microsoft Outlook, Teams, SharePoint and OneDrive. After Microsoft alerted the Government to a potential data breach, the Government's Information Technology and Logistics Department (ITLD) immediately began working to contain the threat, secure affected systems and strengthen existing security measures.

The Government has been working closely with Microsoft and the UK's National Cyber Security Centre (NCSC), which has coordinated specialist cyber security support. A team of experts from NCSC partner organisations travelled to Gibraltar on Monday 2 November to work directly alongside ITLD on the investigation and response.

On Friday 6 November, the Government suspended some services to allow a forensic investigation to take place and additional security measures to be implemented. The Government apologises for the disruption this caused.

ITLD and the specialist teams have taken extensive action to contain the incident and have put additional security measures in place. ITLD continue to monitor and have not seen signs of successful access to the cloud accounts. Access attempts continue but are being blocked. This work continues alongside the forensic investigation.

Importantly, the incident has been identified within the Government's cloud environment. The Government's principal databases containing residents' personal records are maintained separately, within its own data centre and local infrastructure.

However, because the cloud environment also supports Government email and document storage, a detailed forensic investigation remains ongoing to establish the full nature and extent of the incident, including whether any information was accessed or extracted without authorisation. If the investigation finds that anyone's personal data has been affected, the Government will contact them directly. The Government will provide further information as the investigation progresses.

The Government wishes to recognise the exceptional commitment of ITLD staff, who have worked continuously throughout the past week and over the weekend, alongside specialist international partners, to protect Government systems and minimise disruption to public services.

The Government also takes this opportunity to remind members of the public of the importance of good cyber security practices:

• Be wary of unexpected emails, texts or calls, even if they appear to come from the Government or someone you know, and do not click on links or open attachments you were not expecting.
• Use a strong, different password for each important account, especially your email.
• Turn on multi-factor authentication (also called two-step verification) wherever it is offered.
• Keep your devices and software up to date.
• The Government will never ask for your password by email, text or phone.

Further advice is available from the National Cyber Security Centre at ncsc.gov.uk.

Cyber security threats are an increasingly common challenge for governments and organisations worldwide. The Government will continue to invest in the resilience of its digital infrastructure and work with specialist partners to strengthen its security further.