UK government cyberattack probe widens as officials cite Chinese-linked possibility

LONDON — Investigations are ongoing into a cyberattack on the UK government, with Trade Minister Sir Chris Bryant saying the inquiry remains under way after October's breach. It is understood a Chinese-affiliated group is suspected of being behind the attack, though officials have not publicly named a culprit. The incident affected Home Office systems operated by the Foreign Office, and the Information Commissioner’s Office has been notified as part of the inquiry.

The National Cyber Security Centre said it is working with government partners to fully understand the impact of the intrusion. Officials have stressed that while the breach is being examined, the government is pursuing multiple lines of inquiry to assess the scope and potential consequences for security and data.

Bryant, speaking earlier on BBC Breakfast, said the security gap was closed pretty quickly and that there is a judgment that it is a fairly low risk that individuals will have been compromised or affected. He reiterated that he was not able to confirm who carried out the attack, saying on Times Radio that he could not say whether the incident is directly related to Chinese operatives, or the Chinese state.

The Sun newspaper reported that the incident occurred in October and that information potentially including visa details may have been targeted. The government has said the Information Commissioner’s Office is involved, underscoring the seriousness with which data protection authorities are treating the breach.

UK intelligence agencies have warned about increasing, large-scale espionage from China, including cyber and other methods aimed at commercial and political information. GCHQ said last year it was devoting more resources to counter threats from China than from any other nation. Education on the likelihood of ongoing targeting was reinforced by officials who stressed that “government facilities are always going to be potentially targeted,” as Bryant noted.

If investigators eventually attribute the breach to a Chinese state-connected group, it would carry political implications ahead of a planned visit to Beijing next year by Labour leader Sir Keir Starmer, the first of a UK prime minister since 2018. Labour has signaled the importance of engaging with China on trade, climate, and other issues, while acknowledging the need to address national security concerns through dialogue and firm policy.

China has consistently denied backing cyber-attacks targeting the UK. A spokesperson for the Chinese embassy in London rejected accusations of espionage as “fabricated, malicious slander,” underscoring the tension between security concerns and diplomatic engagement as UK policymakers seek a careful relationship with Beijing.

Analysts emphasized that many government departments still rely on older information-technology systems, which can complicate rapid containment after incidents. Jamie MacColl, a senior research fellow in cyber and technology at the Royal United Services Institute (RUSI), told the BBC that legacy IT environments are a common vulnerability in government networks. Jake Moore, global cybersecurity adviser for software company ESET, urged continued investment in digital defenses, noting that government departments are likely to remain targeted given the strategic value of their data.

The investigation continues as officials work to reconstruct the breach, assess any data exposure, and determine whether broader reforms to cyber defenses are needed. While authorities have signaled caution about preliminary conclusions, the case reinforces the broader message from UK security agencies about persistent and evolving cyber threats linked to state-backed actors, including those associated with China.