A probe into the premature release of sensitive information from Rachel Reeves’s Budget has revealed that the incident was not due to intentional leakage but rather IT vulnerabilities. The Office for Budget Responsibility (OBR) described the mishap as the most significant failure in its 15-year history and launched an investigation, involving cybersecurity expert Professor Ciaran Martin, after official forecasts were mistakenly made available on its website nearly an hour ahead of schedule.
Budget details are typically kept confidential due to their market sensitivity, and the Chancellor was unaware of the leak until she was in the House of Commons preparing to deliver her speech.
The investigation concluded that there was no evidence of malicious cyber activity by external entities or internal mishandling. Instead, the incident was attributed to two errors related to the use of the WordPress publishing platform by the OBR.
Interestingly, it was discovered that a similar premature disclosure had occurred prior to the Chancellor’s Spring Statement in March, though no significant actions were taken at that time. The investigation revealed that the sensitive document was accessed online between 11:30 and 12:08, with 43 accesses from 32 unique IP addresses.
Treasury minister James Murray emphasized the severity of the breach, labeling it as a serious violation of highly confidential information and a failure of the OBR’s duty. Murray expressed concern over the pre-existing vulnerabilities and the potential early access to the Spring Statement forecast.
The probe highlighted the need for a comprehensive review of the OBR’s document publication procedures to regain trust. It recommended immediate changes to the publication processes for critical documents and a reassessment of all publication practices to prevent similar incidents in the future.