Select committee: Public Accounts Committee
Conclusion 9
24th Report - Government cyber resilience
Published 9 May 2025
Addressed to HM Treasury
Public Accounts Committee Government cyber resilience All items in this report Report on parliament.uk ↗ Inquiry on parliament.uk ↗
Conclusion (the committee's words)
Organised criminal groups use ransomware and data extortion to make money.10 They do this by stealing and encrypting victims’ data and then demanding a ransom or threatening to the leak the data. In October 2023, 5 Q 2; C&AG’s Report, paras 4, 6 6 C&AG’s Report, paras 6, 22 7 Q 4 8 Qq 4–5 9 Q 5 10 Q 5 8 the British Library suffered a ransomware attack, which it was still recovering from a year after the attack.11 The cyber attackers encrypted most of the British Library’s servers, leaked around 500,000 records and stole several terabytes of data. The Cabinet Office told us that responding to the attack cost the British Library between £6 million and £7 million.12 We asked the Cabinet Office for an example of a cyber attack that had affected the public. The Cabinet Office pointed to the June 2024 ransomware attack on Synnovis, a supplier of NHS pathology services, which led to two NHS foundation trusts postponing more than 10,000 appointments and put a significant amount of data at risk. Ransomware attacks on Hackney, and Redcar and Cleveland councils, have also disrupted public services.13
From: Public Accounts Committee, 24th Report - Government cyber resilience (HC 643), 9 May 2025
Government response
Latest Treasury Minutes progress report to the Committee of Public Accounts on the Twenty-fourth Report of Session 2024-26
The government responded to the whole report on 4 June 2026.
Treasury minutes: Government response to the Committee of Public Accounts on the Twenty-fourth report from Session 2024-26
Published 18 September 2025.
Summary written by Accountability Index from the government's response. It is not the government's own words.The government "agrees with the Committee's recommendation" in each of the six areas, setting target implementation dates between winter 2025 and autumn 2026.
- On the evolving threat, the government agrees, notes responsibility has moved to DSIT, and says DSIT will publish an implementation plan in winter 2025 and write to the Committee "in one year's time".
- On cyber skills, it "acknowledges the ongoing cyber skills gaps" and says that "Early next year" DSIT will set how many anticipated vacancies its central initiatives will address and how it will assist departments with the remaining gaps.
- On accountability and funding, DSIT will set expectations for departments to appoint a board member with cyber security and digital resilience expertise, and is "working with HMT on mechanisms for protecting budgets" for cyber and legacy remediation programmes.
- On arm's-length bodies and supply chains, it says departments remain "ultimately accountable for the risk" and that DSIT will "assure and enforce" that Accounting Officers are meeting this responsibility.