---
title: "Gibraltar government cloud intrusion"
description: "Gibraltar confirmed unauthorized cloud access and suspended services while investigators assessed possible email and document exposure."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-10"
canonical_url: "https://www.ally.security/incidents/gibraltar-government-cloud-intrusion-2026"
markdown_url: "https://www.ally.security/incidents/gibraltar-government-cloud-intrusion-2026.md"
stix_url: "https://www.ally.security/incidents/gibraltar-government-cloud-intrusion-2026/stix.json"
---

# Gibraltar government cloud intrusion

The government contained cloud-account access while investigating whether information was accessed or extracted.

Last modified Nov 10, 2026 · 1 source

## Summary

- **Environment:** Government cloud email, collaboration and document services
- **Operational impact:** Some public services suspended for investigation
- **Financial impact:** No confirmed incident cost quantified

## What happened

[HM Government of Gibraltar](https://www.gibraltar.gov.gi/) confirmed unauthorized cloud access in its [November 9 statement](https://www.gibraltar.gov.gi/press-releases/government-confirms-cyber-security-incident-contained-following-extensive-security-measures-8652026-12551). Activity began several weeks earlier; the exact start is unknown. [1](#source-1)

## Impact

The environment supports [Microsoft](https://www.microsoft.com/) Outlook, Teams, SharePoint and OneDrive. Some services were suspended; investigators had not established whether information was accessed or extracted. Principal resident-record databases are hosted separately on local infrastructure. [1](#source-1)

## Timeline

### November 2, 2026 — Specialists arrive

[NCSC](https://www.ncsc.gov.uk/) coordinated partner support. [1](#source-1)

### November 6, 2026 — Services suspended

Forensic work and protective changes prompted disruption. [1](#source-1)

### November 9, 2026 — Intrusion publicly confirmed

Investigation continued after containment. [1](#source-1)

### November 10, 2026 — Briefing updated

This briefing was last reviewed and updated on November 10, 2026.

## Threat Group & Attack Vector

Microsoft alerted ITLD. The government did not explain the initial access method. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Officials said continuing attempts were blocked and monitoring showed no further successful cloud-account access. They promised direct notification if personal-data impact was confirmed. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/gibraltar-government-cloud-intrusion-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Government confirms cyber security incident contained following extensive security measures - 865/2026

official · HM Government of Gibraltar · Nov 9, 2026

<https://www.gibraltar.gov.gi/press-releases/government-confirms-cyber-security-incident-contained-following-extensive-security-measures-8652026-12551>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Gibraltar government cloud intrusion: The government confirmed unauthorized access to its cloud environment, including Outlook, Teams, SharePoint and OneDrive, beginning several weeks before November 9; no exact intrusion date was given.
2. **Affected Organization · 100% confidence · current**  
   Gibraltar government cloud intrusion: HM Government of Gibraltar
3. **Resulted In · 100% confidence · current**  
   Gibraltar government cloud intrusion: On November 9 the government said containment measures were in place, continued access attempts were blocked and monitoring showed no further successful cloud-account access.
4. **Resulted In · 100% confidence · current**  
   Gibraltar government cloud intrusion: Government confirms cloud intrusion
5. **Resulted In · 100% confidence · current**  
   Gibraltar government cloud intrusion: Principal resident-record databases are hosted separately on local infrastructure. Investigators had not yet determined whether email or document information was accessed or extracted; affected people would be notified if confirmed.
6. **Resulted In · 100% confidence · current**  
   Gibraltar government cloud intrusion: Some public services were suspended November 6 for forensic investigation and additional security controls.
7. **Resulted In · 100% confidence · current**  
   Gibraltar government cloud intrusion: Microsoft alerted ITLD, which began containment. NCSC coordinated external specialists who arrived November 2.
8. **Occurred At · 100% confidence · current**  
   Government confirms cloud intrusion: 2026-11-09
9. **Occurred At · 100% confidence · current**  
   Public services suspended for investigation: 2026-11-06
10. **Resulted In · 100% confidence · current**  
   Gibraltar government cloud intrusion: Public services suspended for investigation
11. **Occurred At · 100% confidence · current**  
   NCSC partner specialists arrive: 2026-11-02
12. **Disclosed At · 100% confidence · current**  
   Gibraltar government cloud intrusion: 2026-11-09
13. **Resulted In · 100% confidence · current**  
   Gibraltar government cloud intrusion: NCSC partner specialists arrive

</details>