Delayed cyberattack detection and response
Significant delays in detecting and responding to cyberattack risks within government agencies, despite high-risk ratings.
Strongest theme matches
Mixed across source types and ranked by classifier confidence plus text match strength.
Committee recommendation
82match
#26 - Legal Aid Agency acknowledges critical lessons learned from cyberattack response and provider burden
LAA acknowledged that contingency measures it put in place to keep the legal aid system going placed additional burdens on providers, and that there are several lessons to be learned from the attack. This included, ensuring senior leaders understand risks in systems, ensuring longer term business continuity plans are in place and considering the impact on staff of...
Matched on
terms: cyberattack, response
Committee recommendation
80match
#25 - Legal Aid Agency experienced significant delays in detecting and responding to cyberattack risks
We asked LAA why it had taken so long to detect the attack and to then take systems offline.48 LAA explained that the risk of a cyberattack on its systems had been rated as extremely high on MoJ’s risk registers since 2021. It told us that MoJ had subsequently provided over £50 million in total to help address...
Matched on
terms: cyberattack
Committee recommendation
77match
#6 - Require MoJ and LAA to detail cyberattack lessons and funding for system vulnerabilities.
Despite lessons learned from the cyberattack on the LAA, funding to address weaknesses across MoJ systems is uncertain. Vulnerabilities in LAA’s systems had been on MoJ’s risk register since 2021. However, MoJ’s investment of over £50 million to transform and stabilise LAA’s systems was insufficient to prevent hackers accessing a large amount of both provider and legal aid...
Matched on
terms: cyberattack, response
Committee recommendation
74match
#1 - Committee reviewed HMP Dartmoor lease, legal aid provision, and LAA cyberattack management.
We took evidence from the Ministry of Justice (MoJ), HM Prison and Probation Service (HMPPS) and the Legal Aid Agency (LAA) to follow up on our recent scrutiny of several topics. This included HMPPS’s management of the lease renewal at HMP Dartmoor, MoJ and LAA’s response to the previous Committee’s 2024 report on legal aid and their management...
Matched on
terms: cyberattack, response
PFD report
65match
Linda Banks
The coroner noted that a thematic review of mental health services identified significant issues, but actions were not effectively implemented. Additionally, Serious Incident Investigations continue to be significantly delayed, compromising evidence and patient safety improvements.
Matched on
terms: delayed
Committee recommendation
62match
#24 - Legal Aid Agency cyberattack went undetected for four months before system shutdown
MoJ and LAA acknowledged that the cyberattack on LAA’s online digital services began in December 2024, four months before the LAA detected the attack on 23 April 2025.46 LAA explained that in April, it took action to boost the security of the systems concerned and informed legal aid providers that their bank details may have been compromised. However,...
Matched on
terms: cyberattack
PFD report
61match
Liam Allan
Concerns were raised regarding inadequate lighting and inconsistent reflective markings on riverside buoyancy aids, hindering their rapid deployment. Additionally, the communication process between the Metropolitan Police Service and the London Fire Brigade relies on a slower telephone system instead of faster electronic transfer, potentially delaying emergency response.
Matched on
terms: response
Committee recommendation
60match
#20 - First Report - A hostage to fortune: ransomware and UK national security
It is possible to infiltrate and disrupt ransomware groups’ infrastructure without arresting the criminals involved, sometimes even preventing attacks after the initial 66 A hostage to fortune: ransomware and UK national security infiltration has taken place. The NCA has some offensive capabilities, but it is vital that the UK is able to operate on a level footing with...
Matched on
terms: response
Committee recommendation
57match
#25 - Department maintains a prioritised cyber incident response and business continuity framework
The Department explained that it had a security incident response framework in place that, in the case of a cyber attack, would enable it to keep its services running as much as possible. It told us that its business continuity plan would put in place the most important steps first—getting money to people—with some of its advisory processes...
Matched on
terms: response
Committee recommendation
57match
#12 - First Report - A hostage to fortune: ransomware and UK national security
While the Government maintains that UK victims should not pay ransoms, it is the only viable option for many of those directly affected, enabling them to keep their businesses afloat and prevent damaging leaks of personal data. Too many organisational leaders are left to face this moral dilemma alone, without any state intervention. The NCSC must produce more...
Matched on
terms: response
Committee recommendation
57match
#11 - First Report - A hostage to fortune: ransomware and UK national security
Victims are currently disincentivised to report ransomware attacks, making it difficult to understand fully the nature and scale of the threat, and how best to tackle it. The Director General of the NCA has suggested that it would be unusual for the Government to require any victim of crime to report an attack—but there are usually greater incentives...
Matched on
terms: response
Committee recommendation
57match
#21 - 7th Report - Financial resilience of government-sponsored museums and galleries
Common resilience issues faced by the museums and galleries include the increasing threats they face of cyberattacks and of thefts of items from their collections, as evidenced by the October 2023 cyber-attack at the British Library and the thefts reported in 2023 at the British Museum.47 We therefore asked the Department how it was going to support the...
Matched on
terms: cyberattack
Committee recommendation
56match
#21 - 3rd Report - Science diplomacy: Sovereignty, strategy, and the global race
The UK’s research base is operating in an increasingly contested global environment. The risks to research security are growing but the UK’s response is insufficiently developed. Though the recent breach at UK Biobank illustrated how research collaborations can be exploited by hostile actors, the government’s current “actor agnostic” approach has not translated into clear, practical guidance for those...
Matched on
terms: response
Committee recommendation
56match
#20 - GovAssure reveals significant gaps and low maturity in departmental cyber resilience.
In 2023, the Cabinet Office launched ‘GovAssure’, a cyber security assurance scheme, as part of its strategy to improve government organisations’ cyber resilience. Before GovAssure, departments self–assessed their performance against minimum cyber standards set by the Cabinet Office.43 In the period April 2023 to July 2024, 35 departments took part in the first year of GovAssure and assessed...
Matched on
terms: response
LGO / SPSO decision
56match
22-001-553 - Gloucester City Council
Summary: Mr X complained the Council failed to provide local land charge search results following a cyber attack. He said it caused delay in the sale of his property. The Council failed to provide a service, but its response limited any injustice to Mr X.
Matched on
terms: response
Committee recommendation
53match
#69 - 1st Report - Our friends in the North: UK strategy towards the Arctic
The UK’s Nordic allies are at the front line of Russian sub-threshold operations. Russia regularly engages in a range of disruptive actions to test the Nordic states’ responses and resilience. This includes GPS jamming, military exercises simulating attacks on its neighbours, maritime sabotage, cyber-attacks and information warfare. 75 Professor Niklas Eklund, Chair of politics and public administration at...
Matched on
terms: response
Committee recommendation
53match
#55 - 3rd Report – Access to Justice: Legal Aid
Legal aid providers and clients have been insufficiently compensated for the additional work and data loss caused by the 2025 cyber- attack. The response of the Legal Aid Agency and Ministry of Justice to informing and safeguarding victims has not been good enough. (Conclusion, Paragraph 167)
Matched on
terms: response
PFD report
49match
Georgina Swindells
The coroner identified concerns regarding an unexplained delay in image transfer, the absence of a robust backup system, and insufficient data to investigate the issue. There was also a lack of clarity on the cause of an apparently erroneous scan report.
Matched on
classifier match
PFD report
49match
Leslie Carswell
Technical difficulties transmitting CT scans between hospitals led to delays in treatment planning. The coroner noted these issues are ongoing, risking delays in lifesaving treatment for patients with urgent conditions.
Matched on
classifier match
PFD report
49match
Deborah Hopkinson
Multiple equipment failures, including CT scanners and computer systems, affected treatment and caused delays. Additionally, there was insufficient specialist expertise in Cushing's disease, leading to delays in seeking advice from specialist centres.
Matched on
classifier match
PFD report
49match
Glenys Button
The coroner noted inefficient and archaic neurosurgical referral processes at UHW, handled by a single on-call registrar, leading to delays and miscommunication. Additionally, there is no back-up doctor available for time-critical referrals.
Matched on
classifier match
PFD report
49match
Ian Darwin
Tees Esk and Wear Valleys NHS Foundation Trust routinely delays serious incident investigations, which may allow hazards to persist and compromise the quality of these investigations. This practice does not align with the nationally recognised 60-working day timeframe for completion.
Matched on
classifier match
PFD report
49match
Manoel Santos
The coroner identified concerns regarding the late notification of immigration detention decisions, insufficient signposting of legal advice entitlements for Foreign National Offenders, and communication issues between agencies involved in immigration and sentence planning.
Matched on
classifier match
PFD report
49match
Dean Bray
The coroner noted staff could not make direct 999 calls from the seclusion room observation area, and paramedics faced delays accessing the patient due to an unknown immediate access route to the ward.
Matched on
classifier match
Committee recommendation
49match
#3 - 7th Report - Financial resilience of government-sponsored museums and galleries
The Department is not doing enough to ensure museums and galleries apply learning from recent threats to the physical security of their collections and their cyber security. Museums and galleries face significant challenges on cyber-security and the physical security of their collections, as evidenced by the October 2023 cyber-attack at the British Library and the thefts reported in...
Matched on
classifier match
Committee recommendation
49match
#24 - HMRC’s legacy IT systems pose security, reliability, and cost risks.
HMRC explained that there are three key risks that arise from operating legacy systems: lower levels of security; lower reliability and resilience; and higher costs of system changes. HMRC said that its executive team and its digital team track how up to date its systems are and how that is changing over time. HMRC told us that it...
Matched on
classifier match
Committee recommendation
49match
#9 - Organised criminal groups' ransomware attacks severely disrupt public services and incur significant costs.
Organised criminal groups use ransomware and data extortion to make money.10 They do this by stealing and encrypting victims’ data and then demanding a ransom or threatening to the leak the data. In October 2023, 5 Q 2; C&AG’s Report, paras 4, 6 6 C&AG’s Report, paras 6, 22 7 Q 4 8 Qq 4–5 9 Q 5...
Matched on
classifier match
Committee recommendation
49match
#30 - Mandate EU transport operators inform travellers of UK personal import rules by January 2027 deadline.
Regardless of SPS negotiation timings, the Government must not delay the implementation of the requirement for EU transport operators to draw travellers’ attention to UK rules on personal imports of products of animal origin beyond 31 January 2027. (Recommendation, Paragraph 78)
Matched on
classifier match
ISC report
48match
Russia
Inquiry into the Russian threat to the UK, including interference in democratic processes, cyber activity and the response of the intelligence community.
Matched on
terms: response
Committee recommendation
48match
#20 - Twenty-Second Report - Digital transformation in the NHS
In our 2018 report on the WannaCry Cyber-attack on the NHS, we found that the Department and its arm’s-length bodies were unprepared for the relatively unsophisticated WannaCry attack and had a lot of work to do to improve cyber-security for when, and not if, there was another attack.39 We asked how the NHS was ensuring that it had...
Matched on
terms: cyberattack
Committee recommendation
48match
#7 - Legacy IT systems pose significant risks to government AI adoption and cybersecurity.
DSIT told us that it was a matter of urgency that the issue of legacy systems in government is addressed, not only to take advantage of the opportunities offered by AI, but also to address other risks including cyber security vulnerabilities. It emphasised prioritising the “systems that have the most valuable data” and “the highest levels of security...
Matched on
classifier match
PFD report
45match
Carol Jennings
The coroner noted inadequate referral processes for the Tissue Viability Nurse, including the use of voicemails and a lack of follow-up on referrals. There was also insufficient and inconsistent record-keeping for the patient's wound, lacking detailed descriptions, measurements, and photographs.
Matched on
classifier match
PFD report
45match
Darran Busby
A flaw in the electronic patient record system (EMIS) means double-clicking 'file no comment' can inadvertently file unreviewed radiology results, potentially causing urgent findings to be overlooked. This could lead to lost opportunities for treatment and future deaths.
Matched on
classifier match
PFD report
45match
Daniel Tilley
The coroner identified insufficient funding for the police force to meet increased summer demand, leading to inadequate staffing levels for call handlers, resource deployment officers, and uniformed officers. This resulted in calls not being answered or responded to within adequate timeframes, a problem noted to have persisted for a decade.
Matched on
classifier match
PFD report
45match
Stephen Page
The coroner noted concerns that a visual-only electronic sensor alarm on a CCTV system, lacking an audible component and displaying for only a few seconds, could be easily missed by operators, potentially leading to missed intervention opportunities.
Matched on
classifier match
Committee recommendation
45match
#47 - 11th Report - Toward a new doctrine for economic security
We recommend that the Government consult on proposals for a mandatory malicious cyber incident reporting regime. (Recommendation, paragraph 159)
Matched on
classifier match
Committee recommendation
45match
#46 - 11th Report - Toward a new doctrine for economic security
The UK Government will not be able to confront the threat posed by cyber- attacks without an accurate understanding of the scale of the problem. Currently large British companies are not required to report cyber-attacks. This is detrimental to national economic security. A full picture of these incidents is essential to not only the Government, but also to...
Matched on
classifier match
Committee recommendation
45match
#15 - 11th Report - Toward a new doctrine for economic security
Cyber threats to the UK’s economy, institutions and infrastructure continue to evolve. A string of high-profile attacks in 2025 have vividly demonstrated the devastating impacts of these attacks on workers, consumers and associated supply chains. The boundary between “state” and “non-state” cyber-attackers is becoming increasingly blurred, and the rapid emergence of new technologies will exponentially multiply the damage...
Matched on
classifier match
Committee recommendation
45match
#2 - First Report - A hostage to fortune: ransomware and UK national security
Past attacks demonstrate that ransomware can cause severe disruption to the delivery of core Government services, including healthcare and child protection, as well as causing ongoing economic losses. Mass data loss from an attack can be irreversible, even when the ransom is paid. Given the damage wrought by these uncoordinated ransomware attacks, a coordinated and targeted attack has...
Matched on
classifier match
Committee recommendation
44match
#19 - First Report - A hostage to fortune: ransomware and UK national security
The National Crime Agency is locked in an uphill struggle against the ransomware threat, which is now so sophisticated that even the most highly-protected organisations expect to experience a ransomware attack. There is clear value in the Government’s resilience work, but it is vital that this is paired with further work to raise the costs for attackers, to...
Matched on
classifier match
Committee recommendation
44match
#10 - First Report - A hostage to fortune: ransomware and UK national security
Cyber insurance can provide a vital lifeline for ransomware victims, offering the sort of support and technical advice not offered by state agencies, as well as driving up cyber security standards through conditions of coverage. Unfortunately, there remains a woeful lack of UK coverage: premiums are unaffordable for many organisations, and have increased drastically in recent years. There...
Matched on
classifier match
Committee recommendation
44match
#4 - First Report - A hostage to fortune: ransomware and UK national security
The Government and the National Cyber Security Centre (NCSC)—the public- facing arm of GCHQ—have focused significant efforts on enhancing the UK’s cyber resilience, with particular attention paid to major operators of critical national infrastructure (CNI). Nevertheless, UK CNI remains vulnerable to a catastrophic ransomware attack, particularly in sectors in which investment in upgrading legacy infrastructure has been inadequate....
Matched on
classifier match
Committee recommendation
44match
#22 - 7th Report - Financial resilience of government-sponsored museums and galleries
The Department assured us that it was now working closely with the organisations on how it can provide central advice on improving cyber-resilience and minimising the threat and impact of cyber-attacks. It highlighted the Government’s cyber action plan, which the Department for Science, Innovation and Technology published earlier this year, which it said was setting out a path...
Matched on
classifier match
Committee recommendation
44match
#8 - Thirtieth Report - Challenges in implementing digital change
The risks associated with legacy systems include that they can be difficult and expensive to support, lack operational resilience for key government services, and be vulnerable to cyber-attack. This exposes government to what is likely to be an uncertain but high level of financial risk from potential operational and cyber-related incidents. Legacy systems need a significant level of...
Matched on
classifier match
HMICFRS recommendation
43match
FRS 2018-19 CoC Recommendations: Cornwall Fire and Rescue Service
Cause of concern: We have serious concerns about Cornwall FRS’s response to incidents. The service consistently doesn’t meet target response times for fires, especially in remote areas served by on-call stations. It is sometimes slow to update mobile data terminals with risk information. Staff often rely on paper records. Staff in the critical control centre aren’t confident in...
Matched on
terms: response
HMICFRS recommendation
43match
FRS 2023-25 CoC Recommendations: Avon Fire and Rescue Service
Cause of concern: The service’s mobilisation system, which records information and dispatches resources to emergency incidents, isn’t reliable and crashes during emergency 999 calls. This unnecessarily delays the mobilisation of resources, which results in the public receiving a slower response to emergencies. Recommendation: By 19 September 2023, the service should develop an action plan to make sure its...
Matched on
terms: response
Committee recommendation
41match
#1 - First Report - A hostage to fortune: ransomware and UK national security
A major ransomware attack could have a devastating impact on UK citizens and the economy, and undoubtedly represents a major threat to UK national security. A sophisticated ransomware ecosystem has evolved, with criminals able to purchase advanced forms of malware and access points in order to conduct profitable and damaging attacks. This has made it much more widely...
Matched on
classifier match
Committee recommendation
41match
#36 - HMRC acknowledges legacy IT systems and poor data management hinder AI adoption and increase cyber risks.
We asked HMRC whether the age of some of its IT systems were going to make it more difficult to adopt AI. HMRC agreed and considers the “critical thing with AI is making sure you really have a handle on where your data is and that you are managing your data well.” 72 We also asked HMRC about...
Matched on
classifier match
Committee recommendation
41match
#31 - HMRC acknowledges security concerns with third-party Making Tax Digital software, setting strict specifications.
We asked HMRC whether there were potential security concerns that could be posed by the third–party MTD software taxpayers use to submit their tax returns, including whether there were risks to HMRC’s own systems.63 In written evidence provided after our evidence session, HMRC told us it takes security very seriously. It said all data sent to HMRC systems...
Matched on
classifier match
CJINI report
41match
A review of how the criminal justice system deals with cyber crime in Northern Ireland- Follow-Up Review
Matched on
classifier match