Govt says cyber security incident contained as investigation continues

The Gibraltar Government said on Monday it had contained a cyber security breach involving unauthorised access to its cloud systems, as investigators work to establish whether anyone accessed or extracted information.

The incident began several weeks ago and affected parts of the Government’s cloud environment, which supports email and document storage and includes Microsoft Outlook, Teams, SharePoint and OneDrive.

The Government said it was still detecting attempts to access cloud accounts but was blocking them.

The Information Technology and Logistics Department [ITLD] had seen no signs of successful access during ongoing monitoring, No.6 Convent Place said in a statement.

The Government 's main databases containing residents’ personal records are held separately in its own data centre and on local infrastructure.

But because the cloud environment also supports Government email and document storage, investigators are still working to establish the full nature and extent of the incident, including whether any information was accessed or extracted without authorisation.

It said it would contact anyone directly if the forensic investigation found their personal data had been affected.

The ITLD began work to contain the threat and secure affected systems after Microsoft alerted the Government to a potential data breach.

The UK’s National Cyber Security Centre coordinated specialist support, and experts from its partner organisations travelled to Gibraltar on November 2 and continue to work alongside the department on the investigation and response.

The Government suspended some services on November 6 to allow forensic work and put additional security measures in place.

It apologised for the disruption and said it would provide further information as the investigation progressed.

No.6 urged people to be wary of unexpected emails, texts or calls, even if they appeared to come from an official source or someone they knew, adding it would never ask for a password by email, text or phone.

There was no confirmation yet as to who officials believe was behind the hack but the revelation that the Government's cloud systems had been compromised comes after recent high-profile hacks impacting the UK and other European countries, including one targeting supermarket freezers.

Speaking just last week at the launch of an annual report, NSCSC head Dr Richard Horne warned Britain faces the prospect of AI-boosted attacks on critical national infrastructure.

Hackers demanding ransom payments are “highly likely” to use AI to target the UK and hostile states such as Russia and China will routinely use the technology to pursue their goals, the report found.

“It is clear that our nation is living through a moment that, in hindsight, we will see as one of enormous consequence," he said.

“A ‘sliding doors’ moment. A moment of choice."

“In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents."

“But we must be clear that is not because AI has invented new ways to attack us, but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable."

“And because far too many of our organisations and supply chains rest on weak technology and operational foundations.”

The NCSC annual report said that its incident management team received 1,831 reports this year of cyber attacks, of which 337 required support and 80 were nationally significant.

The team also warned 8,500 organisations when their systems had been compromised by attackers, the report added.