An investigation into the premature release of sensitive information from Rachel Reeves’s Budget revealed that it was due to IT vulnerabilities rather than intentional disclosure. The Office for Budget Responsibility (OBR) described the incident as the most significant failure in its 15-year history and initiated a probe with the assistance of cybersecurity expert Professor Ciaran Martin after early uploading of official forecasts on its website.
Typically, Budget details are confidential until officially announced as they hold market-sensitive information. The Chancellor was unaware of the leak until she was in the Commons chamber preparing to deliver her speech.
The investigation determined that the incident was not a result of hostile cyber activities but rather two errors associated with the WordPress publishing platform used by the OBR. Interestingly, a similar early disclosure occurred before the Chancellor’s Spring Statement in March, which was deemed non-malicious.
During the time the document was mistakenly available online, it was accessed 43 times by 32 unique IP addresses. The investigation highlighted that the initial successful request came from an IP address that had made multiple unsuccessful attempts earlier, indicating persistent efforts to access the information.
In response to the breach, Treasury minister James Murray expressed serious concerns about the pre-existing vulnerabilities and the potential early access to the Spring Statement forecast. He emphasized the importance of safeguarding market-sensitive information and the need to prevent such occurrences in the future.
The report emphasized the need for a comprehensive review of the OBR’s document publishing procedures to rebuild trust. It called for immediate changes in the publication processes for critical documents like biannual forecasts and suggested a thorough review of all publication arrangements.