United Kingdom

Analyse

Primarily a target — 7 received· 0 initiated· 2 responses ·NATO

In the last 60 days, 7 new cyber operations involving United Kingdom were added to the database: a 12% decrease compared to the previous period. The number of operations is currently 21% below the long-term 60-day average. The Intensity of cyber operations involving United Kingdom over the last 60 days is rising to 3.3, compared with 2.8 in the preceding 60-day period. This is above the all-time average for United Kingdom of 2.8.

Maintained by EuRepoC research analysts · updated 16 Oct 2026

7received initiated0

For last 60 days, this country appears chiefly as a target — 7 incidents directed at it, 0 it is linked to initiating.

Source: EuRepoC Global Database as of 16 Oct 2026.

01 / 02

Cyber activity

7 incidents · as target

As target 7 As actor 0

Incidents directed at United Kingdom targets, and the responses they drew.

Cyber incident intensity

Mean3.5/15Moderate

Range 3.0–4.0

Drag the ends of the observed range to narrow intensities.

Minimum Maximum

6 coded incidents · Last 60 days

Database additions by weekincidents against United Kingdom

Bar height shows incidents added during last 60 days; select a bar to filter this interval; hover for average intensity.

Most-targeted sectorswhat gets hit

SectorIncidentsIntensityResponded

Civil service / administration 2 1.5Moderate 0/2 Energy 2 2.0Moderate 1/2 Government / ministries 2 1.5Moderate 0/2 Defence industry 1 0.0Moderate 0/1 Telecommunications 1 0.0Moderate 0/1 End user(s) / specially protected groups 1 4.0Moderate 0/1 Police 1 3.0Moderate 0/1 Finance 1 4.0Moderate 0/1

Civil service / administration is the most-targeted sector — 2 of 7 incidents, 0 answered.

By originwho is behind activity against it

Iran, Islamic Republic of 3incidents avg 2.3 · Moderate Korea, Democratic People's Republic of 1incident avg 4.0 · Moderate

02 / 02

Incidents received & responses

AUUSJPDE4 statesjoint WaterPlum Four International Partners Published Joint Security Advisory on North Korean Cyber Activities on 18 September 2026 Official policy 18 Sep 2026

Official policy 18 Sep 2026

AUUSJPDE4 states WaterPlum

Four International Partners Published Joint Security Advisory on North Korean Cyber Activities on 18 September 2026

Unknown United Kingdom ·Police Unattributed Threat Actors Breached Dyfed-Powys Police in the United Kingdom on 14 September 2026 14 Sep 2026

Incident · Unattributed 14 Sep 2026

Unknown United Kingdom ·Police

Unattributed Threat Actors Breached Dyfed-Powys Police in the United Kingdom on 14 September 2026

Unknown United Kingdom ·Finance Unknown Threat Actor Stole Sensitive Customer Information From Revolut Through Fake Government Requests in United Kingdom in September 2026 1 Sep 2026

Incident · Unattributed 1 Sep 2026

Unknown United Kingdom ·Finance

Unknown Threat Actor Stole Sensitive Customer Information From Revolut Through Fake Government Requests in United Kingdom in September 2026

FulcrumSec United Kingdom ·Transportation FulcrumSec Breached Manchester Airports Group in the United Kingdom on the Weekend of 22 August 2026 22 Aug 2026

Incident · Low severity 22 Aug 2026

FulcrumSec United Kingdom ·Transportation

FulcrumSec Breached Manchester Airports Group in the United Kingdom on the Weekend of 22 August 2026

USFederal Bureau of Investigation Mabna Institute US Department of Justice Charged 17 Iranians with Cyber Theft on behalf of the Islamic Revolutionary Guard Corps on 18 August 2026 Criminal proceedings 18 Aug 2026

Criminal proceedings 18 Aug 2026

USFederal Bureau of Investigation Mabna Institute

US Department of Justice Charged 17 Iranians with Cyber Theft on behalf of the Islamic Revolutionary Guard Corps on 18 August 2026

Unspecified Iran-linked threat actor (possibly IRGC-affiliated) United Kingdom ·Energy Iran-Linked Threat Actor Disrupted Small Gas-Fired Power Plant in the United Kingdom for Four Days in July 2026 1 Jul 2026

Incident · Low severity 1 Jul 2026

Unspecified Iran-linked threat actor (possibly IRGC-affiliated) United Kingdom ·Energy

Iran-Linked Threat Actor Disrupted Small Gas-Fired Power Plant in the United Kingdom for Four Days in July 2026

WaterPlum (313 General Bureau of the Munitions Industry Department) ADAEAFAL+185189 countries ·End user(s) / specially protected groups North Korea's WaterPlum aka Contagious Interview Infected at Least 30,000 Devices of IT Professionals in Over 100 Countries from December 2025 to July 2026 1 Dec 2025

Incident · Low severity 1 Dec 2025

WaterPlum (313 General Bureau of the Munitions Industry Department) ADAEAFAL+185189 countries ·End user(s) / specially protected groups

North Korea's WaterPlum aka Contagious Interview Infected at Least 30,000 Devices of IT Professionals in Over 100 Countries from December 2025 to July 2026

MuddyWater (MOIS) ADAEAFAL+185189 countries ·Civil service / administration +4 Iranian State-Sponsored Hacking Group MuddyWater Conducted Espionage Against Government and Private-Sector Organisations in Asia, Africa, Europe and North America Since 2018 1 Jan 2018

Incident 1 Jan 2018

MuddyWater (MOIS) ADAEAFAL+185189 countries ·Civil service / administration +4

Iranian State-Sponsored Hacking Group MuddyWater Conducted Espionage Against Government and Private-Sector Organisations in Asia, Africa, Europe and North America Since 2018

Showing the 8 most recent of 9 Open all in advanced search