Gibraltar government confirms cyber security incident contained following ...

Technical teams isolate cloud breach as UK specialists join response to safeguard public data

HM Government of Gibraltar has confirmed it has contained a cyber security incident affecting elements of its cloud-based IT environment, following swift intervention by technical teams and international specialists.

The incident, which originated several weeks ago, involved unauthorised access to the Government’s cloud infrastructure, including services such as Microsoft Outlook, Teams, SharePoint and OneDrive. Upon being alerted to a potential data breach by Microsoft, the Information Technology and Logistics Department (ITLD) immediately initiated containment protocols, securing affected systems and reinforcing existing defenses.

Good Cyber Security Practices

Members of the public are reminded to maintain strong digital hygiene to protect their personal information online:

Exercise caution with communications: Be wary of unexpected emails, text messages or phone calls - even if they appear to originate from the Government or a known . Do not click links or open unsolicited attachments.

Maintain unique credentials: Use a strong, distinct password for every important account, particularly primary email addresses.

Enable multi-factor authentication: Turn on multi-factor authentication (two-step verification) on all services where it is offered.

Keep software updated: Ensure all operating systems, applications and devices are updated regularly with the latest security patches.

Protect sensitive data: The Government will never ask for your password via email, text or telephone.

Further guidance and resources are available from the National Cyber Security Centre at

To support the response, the Government partnered closely with Microsoft and the UK’s National Cyber Security Centre (NCSC). A team of specialist cyber security experts from NCSC partner organisations arrived in Gibraltar on Monday 2 November to work directly alongside ITLD on the investigation.

On Friday 6 November, several public services were temporarily suspended to allow for a comprehensive forensic investigation and the deployment of additional protective measures. The Government has apologised for the inconvenience caused during this period.

ITLD and specialist external teams report that the incident is contained. Continuous monitoring shows no evidence of successful access to cloud accounts, with ongoing unauthorised access attempts being actively blocked.

Crucially, the breach was confined entirely to the cloud environment. The Government's principal databases containing residents' personal records are stored separately within local infrastructure and a dedicated data centre, leaving them uncompromised.

However, as the cloud environment handles internal emails and document storage, a detailed forensic investigation continues to determine whether any information was accessed or extracted without authorisation. The Government confirmed it will any individuals directly should the investigation reveal their personal data was impacted.