Major UK Cyber Attacks and Data Breaches in 2026: Key Incidents and Lessons

Five years in prison, £1.9 billion in economic damage, £50 million spent on security improvements, and a breach happened anyway. 2026 hasn't been defined by new attacker tricks. It's been defined by the consequences of 2025's biggest breaches finally landing: prison sentences, nine-figure recovery bills, and government reports turning last year's headlines into this year's case studies. Meanwhile, a fresh wave of incidents shows the same weaknesses, legacy systems, shared IT infrastructure, and third-party access, are still being exploited.

Here's a rundown of the Cyber Attacks that mattered most in 2026, and what they tell UK organisations about where the risk really sits.

Attacks and disclosures in 2026

A vulnerability in Companies House's WebFiling service left the personal data of company directors across 5 million registered UK businesses accessible to anyone with a login. The flaw was discovered on 13 March 2026, but traced back to October 2025, when the platform migrated to GOV.UK One Login, the government's single sign-on framework. It's a reminder that migrations and platform changes are a common source of exposure, not just external attacks.

London councils — resident notifications, January 2026

Westminster, Kensington & Chelsea, and Hammersmith & Fulham councils were hit by a cyberattack in November 2025 that exploited their shared IT infrastructure. By January 2026, Kensington & Chelsea had written to hundreds of thousands of households warning that sensitive personal information may have been taken. The case is a clear illustration of how shared services between organisations, intended to cut costs, can also multiply the blast radius of a single breach.

Legal Aid Agency — Public Accounts Committee report, January 2026

A Public Accounts Committee report revealed that the Ministry of Justice had spent £50 million on cyber security improvements at the Legal Aid Agency before its 2024–25 breach, after the agency's cyberattack risk had been rated "extremely high" on its own risk register since 2021. The breach itself exposed up to 18 years of applicant data, including sensitive information tied to criminal and domestic abuse cases. The lesson: known risk, insufficient action, and a very costly outcome.

TfL (Transport for London) hackers sentenced — July 2026

Two men, Thalha Jubair and Owen Flowers, were sentenced to five years and six months in prison for the cyberattack that struck Transport for London in September 2024, when they were teenagers. The attack disrupted services including Live Tube arrivals and Oyster photocard applications, and exposed personal data for around 5,000 customers, including bank details. Both were linked to the Scattered Spider collective, also tied to the 2025 attacks on Marks & Spencer and Co-op. While the attack itself dates to 2024, the sentencing is a 2026 milestone worth noting: it shows UK law enforcement is now securing serious custodial sentences for cybercrime, even against attackers who were minors at the time.

Department for Education (DfE) — July 2026

The DfE confirmed a data breach after a threat actor calling itself ExfilSquad targeted two external-facing systems: the department's online customer help desk and the Turing Scheme portal, which administers international education funding. Around 607,000 records were stolen, including names, job titles, work email addresses and phone numbers belonging to headteachers, university staff, and government officials. The attack was carried out through social engineering rather than a technical exploit, and the stolen data was subsequently published online. No financial information was taken, and the DfE referred itself to the ICO and engaged the NCA and NCSC. The incident raises an uncomfortable question for the wider public sector: if a department managing data on hundreds of thousands of educators and officials can be breached through a help desk, how many other departments share the same exposure?

Global incident relevant to UK organisations

Canvas (Instructure) — April–May 2026

Not a UK incident, but one with direct UK relevance given how widely Canvas is used across UK schools and universities. Unauthorised actors accessed systems belonging to Instructure, the company behind the Canvas learning management platform, on 25 April 2026. The intrusion was detected four days later, and Instructure revoked access and brought in third-party forensics. Data taken included names, email addresses, student ID numbers, and messages exchanged between users, no passwords, birth dates, government IDs, or financial data were confirmed involved.

Instructure believed the incident was contained by 6 May. It wasn’t; the group ShinyHunters struck the next day again, replacing the Canvas login page with a ransomware message and publicly claiming responsibility. The compromised data was reportedly deleted following the incident. For any UK institution using Canvas or a similar EdTech platform, it's a reminder that "contained" isn't the same as "over," and that vendor breach notifications should be followed up on, not treated as the final word.

Common patterns across 2026 UK Cyber Attacks

Looking across every incident covered here public sector, retail, manufacturing, and the global Canvas breach the same handful of patterns keep showing up:

Third-party and vendor access as the entry point:  The London councils' shared IT services turned one weak point into three breaches at once; and the Companies House flaw traced back to a platform migration rather than the organisation's own core systems. The common thread: the weakest point in the chain is rarely the organisation itself.

Social engineering over technical exploits: TfL, the DfE, and the 2025 retail attacks were all initiated by impersonating staff to help desks or support teams to reset credentials or bypass multi-factor authentication not by exploiting software flaws.

Known risks went unaddressed: The Legal Aid Agency had rated its own cyberattack risk "extremely high" since 2021, yet the breach still happened. Identifying a risk on a register isn't the same as closing it.

Attackers often go unnoticed for weeks: In several cases, attackers had access for days or weeks before discovery, giving them time to map networks and locate the most valuable data before extraction.

Contained doesn't always mean over. The Canvas (Instructure) breach is the clearest example: the vendor declared the incident resolved, only for the same attacker to strike again days later. Any organisation relying on a supplier's word that an incident is closed should verify independently before standing down.

Lessons learned from the attacks so far

1. Help desks and support teams are now a primary attack surface: TfL (Transport for London), the DfE (Department of Education) and multiple 2025 retail attacks were all initiated through social engineering against support staff. Verifying identity before resetting credentials or granting access needs to be treated as a security control, not just a customer service step.

2. Third-party risk is organisational risk: Vetting a supplier once isn't enough the access they hold into your systems needs ongoing monitoring, because attackers increasingly go through the weakest link in the chain rather than the strongest.

3. Known risks need funded action, not just documentation: The Legal Aid Agency had rated its own cyberattack risk "extremely high" for years before it was breached. Identifying a risk on paper doesn't reduce it only remediation does.

4. Detection speed limits damage: The organisations that fared best were the ones that identified unusual activity early and contained it, rather than those with the most sophisticated defences on paper.

5. Consequences are becoming more serious, on both sides: The TfL sentencing shows courts are now handing down years-long custodial sentences for cybercrime, but the financial and reputational cost to victim organisations, from JLR's £1.9 billion impact to the Legal Aid Agency's £50 million in pre-breach spending, is climbing just as fast.

Staying off next year's list

Every organisation named above had cyber security measures in place. What separated a contained incident from a national headline was usually preparation: knowing where the weak points were before an attacker did, and having a tested plan for when things go wrong.

The patterns are consistent enough now to act on, help desks are a target, third-party access needs ongoing scrutiny, and known risks left undocumented on a register don't get any safer with time. A penetration test or incident response review can show you exactly where those gaps sit in your own environment, before you end up on next year's list. Explore our penetration testing services or get in touch to strengthen your cyber security posture.