HM Government of Gibraltar said on Monday 9 November that it had contained a cyber security breach. An unknown party had unauthorised access to parts of the government's cloud environment, the systems behind its email and document storage, including Microsoft Outlook, Teams, SharePoint and OneDrive. The statement came from No.6 Convent Place and was reported by the Gibraltar Chronicle and Europa Sur. It says the intrusion began "several weeks ago" and that Microsoft first raised the alarm by warning the government of a possible data breach. The government has not ruled out that information was accessed or taken. No attacker has been named, no figures for affected people or records have been released, and the forensic investigation is still running.
What Happened
The government's account, as reported by both outlets, gives this sequence:
- Several weeks before disclosure: An attacker gains unauthorised access to parts of the government's Microsoft cloud environment. The government has not given an exact start date.
- Detection: Microsoft alerts the government to a possible data breach. The Information Technology and Logistics Department (ITLD) then starts work to contain the threat and secure affected systems. The government's statement suggests the intrusion was spotted by Microsoft, not by the government's own monitoring.
- 2 November: The UK's National Cyber Security Centre (NCSC) coordinates specialist support. Experts from its partner organisations fly to Gibraltar and work alongside ITLD on the investigation and response, together with Microsoft.
- 6 November: The government suspends some services so forensic work can go ahead and extra security measures can be put in place. It has apologised for the disruption.
- 9 November: Public confirmation that the incident is contained.
The government says it is still detecting attempts to get into cloud accounts, but is blocking them. ITLD reports no successful access since monitoring was stepped up. The attacker, or someone else, is still targeting the environment, so the government's description of the incident as "contained" applies to the original access, not to the threat as a whole.
Two recent events are unrelated to this intrusion. On 14 October, ITLD's Cyber Division and the Office of Civil Contingencies ran a tabletop exercise with around 50 participants from government, emergency services, utilities, the Ministry of Defence and the Foreign, Commonwealth and Development Office. The exercise simulated a ransomware attack on government IT. According to the government's account, the real intrusion was probably already underway when that exercise took place. Separately, on 22 October, several official Gibraltar websites showed browser security warnings after GoDaddy revoked 404,607 wrongly issued certificates worldwide. The government said at the time that this was a GoDaddy error and not a breach, and nothing published since connects it to the cloud intrusion.
What Was Taken
It is not yet known. The government has not confirmed that any data was accessed or taken, and it has not ruled it out. Europa Sur's headline says plainly that the government "does not rule out data theft."
What has been said:
- Possibly exposed: Government email, Teams communications and documents held in SharePoint and OneDrive. Because the environment carries day-to-day government correspondence and files, investigators are still working out "the full nature and extent" of the incident.
- Said to be separate: The government's main databases of residents' personal records sit in its own data centre and on local infrastructure, not in the affected cloud environment. The government has not said whether any of that personal data also turns up in emails or documents stored in the cloud. In most organisations a lot of it does.
- Notification: The government says it will contact people directly if the forensic investigation finds their personal data was affected.
No count of affected people, mailboxes or files has been published. No ransom demand, leak-site listing or claim of responsibility has been reported. Gibraltar has its own version of GDPR and a Data Protection Act, amended in July 2026, and the Gibraltar Regulatory Authority is the data protection regulator. No regulator statement on the incident has been published.
Why It Matters
A government's email and files are a target for spies, not only criminals. A quiet, weeks-long presence in a government's Outlook, Teams and SharePoint fits the pattern of intelligence gathering more closely than a financially motivated attack. No ransomware has been reported and no data has been dumped. That is an inference, not a finding: no one has attributed the attack, and the Chronicle notes officials have given no indication of who they believe is responsible. Gibraltar's position adds weight to the question. It is a British Overseas Territory with a Ministry of Defence presence, a strategic port, and ongoing UK-EU-Spain treaty negotiations, all of which make its government correspondence valuable to foreign intelligence services.
The provider spotted it first. The intrusion was found when Microsoft alerted the government, weeks after access began. Any organisation that relies on Microsoft 365's default logging, without someone actively watching sign-ins and mailbox activity, could miss a similar intrusion for just as long.
Practice is not the same as finding attacks. Gibraltar had just rehearsed a ransomware scenario. Ransomware announces itself. The real intrusion was quiet access to cloud accounts, which leaves very different evidence and needs different detection.
The NCSC sent people in person. The UK's NCSC organised expert support and had partners on the ground within what appears to be a short time after detection. That tells you how seriously London is treating the incident.
The Attack Technique
The government has not said how the attacker got in. Its statement says only that there was "unauthorised access" to cloud systems. Two details point to accounts and identity rather than a software flaw:
- The government says it keeps seeing, and blocking, attempts to access cloud accounts. That suggests stolen credentials, password-guessing, or attempts to reuse stolen session tokens.
- Its public advice warns people about unexpected emails, texts or calls that look official or appear to come from someone they know, and says the government will never ask for a password. That is the standard warning when an attacker may hold real government mailboxes and contact lists and could use them for convincing phishing.
Do not connect this to ToolShell. Kaspersky's Securelist published research on 5 November about Storm-2603 exploiting the ToolShell vulnerabilities (CVE-2025-53770 and CVE-2025-53771). Those flaws affect self-hosted (on-premises) SharePoint servers, not SharePoint Online in Microsoft 365. Nothing published links Storm-2603, ToolShell or Kaspersky's research to the Gibraltar incident. It is useful background for anyone running their own SharePoint servers, but it says nothing about who attacked Gibraltar or how.
Until the investigation reports, the realistic ways in are the usual ones for Microsoft 365: stolen or phished credentials, multi-factor approvals tricked out of users, stolen session tokens, OAuth app consent abuse, or a compromised third-party or administrator account.
What Organizations Should Do
- Hunt your Microsoft 365 tenant for quiet access now. Review Entra ID sign-in logs for logins from unusual countries or hosting providers, sessions reused from new devices, and "impossible travel." Check the Unified Audit Log for MailItemsAccessed events, large SharePoint or OneDrive downloads, and new inbox rules that forward or delete mail.
- Audit OAuth apps and service principals. List all enterprise apps with permissions such as Mail.Read, Files.Read.All or Sites.Read.All. Remove any you don't recognise, and require admin approval for user consent.
- Make it harder to steal or reuse logins. Use phishing-resistant MFA (FIDO2 or passkeys) for administrators and senior staff. Block legacy authentication. Use Conditional Access to require managed devices for access to email and SharePoint. Turn on token protection where your licences allow it.
- Plan for when the alert comes from your provider. Decide in advance who receives and acts on a breach notice from Microsoft or another cloud provider. Know how to revoke all sessions, reset credentials and preserve logs within hours. Check that your log retention covers a dwell time of weeks, not days.
- Rehearse the quiet scenario too. Add a slow, stealthy theft of cloud data to your tabletop exercises alongside ransomware. Test whether your team can show what was read, not just what was encrypted.
- Warn users before the phishing starts. If your email or contacts may have been exposed, tell staff and the public, as Gibraltar did, to expect convincing messages that appear to come from you, and to confirm requests through a separate channel. People in Gibraltar should change any reused passwords, turn on extra login checks, and treat unexpected "official" contact with caution.
Sources: Govt says cyber security incident contained as investigation continues | How to detect fileless attacks exploiting ToolShell: analyzing the... | Gibraltar investiga un ciberataque a sus sistemas informáticos y no... | Government Tests Gibraltar’s Resilience During Cyber Security Exerc... | Un fallo global de GoDaddy afecta a varias webs oficiales de Gibraltar | Government tests cyber resilience in tabletop exercise | Data Protection in Gibraltar Jurisiti Europe | Protect yourself after a company loses your personal data The Cent...