Incident BriefingsGibraltar government cloud intrusion

Gibraltar government cloud intrusion

The government contained cloud-account access while investigating whether information was accessed or extracted.

Last modified

Summary

  • Environment: Government cloud email, collaboration and document services
  • Operational impact: Some public services suspended for investigation
  • Financial impact: No confirmed incident cost quantified
  • Record status: Developing record. Reviewed November 10, 2026; updated as evidence emerges.

What happened

HM Government of Gibraltar confirmed unauthorized cloud access in its November 9 statement. Activity began several weeks earlier; the exact start is unknown. [1]

Impact

The environment supports Microsoft Outlook, Teams, SharePoint and OneDrive. Some services were suspended; investigators had not established whether information was accessed or extracted. Principal resident-record databases are hosted separately on local infrastructure. [1]

Timeline

  1. Specialists arrive

    NCSC coordinated partner support.

    [1]

  2. Services suspended

    Forensic work and protective changes prompted disruption.

    [1]

  3. Intrusion publicly confirmed

    Investigation continued after containment.

    [1]

  4. Briefing updated

    This briefing was last reviewed and updated on November 10, 2026.

Threat Group & Attack Vector

Microsoft alerted ITLD. The government did not explain the initial access method. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

Officials said continuing attempts were blocked and monitoring showed no further successful cloud-account access. They promised direct notification if personal-data impact was confirmed. [1]