Gibraltar’s government has admitted that intruders got into its Microsoft 365 estate several weeks ago, and that it moved to contain them after a warning from Microsoft. NCSC-coordinated responders are on the Rock, some public services have been paused, and nobody can yet say whether official email and documents left the building.
What happened
On Monday 9 November 2026, No.6 Convent Place issued a statement confirming a cyber security incident affecting parts of the Government of Gibraltar’s cloud environment. The affected tenancy underpins the administration’s email, collaboration and file storage: Outlook, Teams, SharePoint and OneDrive were all named. According to the statement, the unauthorised access began “several weeks ago”.
The Government says its Information Technology and Logistics Department (ITLD) started containment work after Microsoft notified it of a potential breach. The UK’s National Cyber Security Centre (NCSC) then coordinated specialist support, and experts from NCSC partner organisations arrived in Gibraltar on 2 November to work alongside ITLD. On Friday 6 November some services were taken offline so that forensic examination could proceed and extra controls could be put in place.
Officials stress two points. First, the principal databases holding residents’ personal records live in the Government’s own data centre on local infrastructure, separate from the cloud tenancy, and are described as unaffected. Second, attempts to get into cloud accounts are continuing but are being blocked, and the Gibraltar Chronicle reports that ITLD monitoring has shown no sign of those newer attempts succeeding. The Chronicle’s headline describes the incident as contained.
What the Government cannot yet say is whether anything was read or taken. Because the tenancy holds official email and documents, investigators are still working out the full scope. Anyone whose personal data turns out to be involved will be contacted directly. Officials have not said who they believe was behind the intrusion. The Olive Press, which reported that the breach had gone unnoticed locally until Microsoft flagged it, says investigators are also examining whether emails and documents relating to cross-border workers and foreign residents were accessed.
The technical picture
Very little technical detail has been released, and it would be wrong to guess at the initial access route. What the public statements do tell us is still useful to defenders.
The detection came from the platform provider. That the first warning came from outside suggests the attacker’s activity looked, from the inside, much like ordinary user behaviour: signing in, reading mail, browsing SharePoint sites and syncing files. That is typical of identity-led intrusions into Microsoft 365, where the attacker holds a valid session or credential and no malware ever touches an endpoint.
The ongoing, blocked access attempts are also telling. Persistent retries after discovery often mean the intruder knew of more than one way in, or still holds credential material that has since been invalidated: stolen passwords, refresh tokens, app registrations or consented OAuth applications. Suspending services for forensics points to responders wanting a clean baseline: revoking sessions, reviewing app consents and mailbox rules, and rotating secrets before restoring normal working.
Finally, the separation of the residents’ databases from the cloud tenancy is a genuine architectural win, but email and document stores are rarely free of personal data. Casework, scanned forms and attachments tend to accumulate in exactly the services that were exposed.
Why it matters for UK organisations
Gibraltar is a British Overseas Territory, and the NCSC’s involvement shows how closely its security is tied to the UK’s. Government email in a territory with a sensitive border relationship with Spain and the EU is an obvious intelligence target.
For UK organisations the lesson is less about geopolitics and more about dwell time. The bulk of UK public bodies, councils, schools and SMEs now run on Microsoft 365. If a national administration with its own IT department can end up learning of an intrusion from its supplier, many smaller tenants with default logging and no one watching sign-in alerts are at least as exposed.
There is also a data protection angle. Where personal data in email or SharePoint is compromised, UK organisations face the same question Gibraltar now does: whether, and how quickly, affected people must be told. Under UK GDPR, the 72-hour clock for notifying the ICO starts when you become aware of a breach. That clock may not start until your supplier tells you, but regulators and the people affected will still ask why your own monitoring missed it.
The incident lands a week after the NCSC’s annual review, which logged 1,831 incident reports over the year, 80 of them nationally significant, and warned of a likely rise in incidents driven by long-tolerated weaknesses.
Expert view
In my experience, the cloud tenant is where many organisations’ monitoring quietly stops. Firewalls and endpoints get detection budgets; the identity layer gets a default configuration and a hope that Microsoft is watching. Sometimes it is, as here, but a third-party tip-off is a safety net, not a control.
When we assess Microsoft 365 estates, the same gaps come up repeatedly: legacy authentication still allowed for a handful of service accounts, conditional access policies with broad exclusions, audit logs retained only for the default period, and nobody reviewing which third-party apps hold delegated mail or file permissions.
I would credit the Gibraltar Government for two things: keeping core registers off the shared cloud platform, and being fairly open while the investigation is live. The uncomfortable part is the detection gap. Undetected access to an email system gives an adversary the opportunity to read sensitive correspondence and harvest material for convincing follow-on phishing, which is exactly why officials are urging residents to treat unexpected messages with suspicion.
What to do now
- Check you would see it yourself. Make sure unified audit logging is on, sign-in and audit logs are kept for well beyond the default (ideally 12 months), and alerts for risky sign-ins, impossible travel and new inbox rules reach a human.
- Enforce phishing-resistant MFA. Apply MFA to every account through conditional access, prioritising administrators, and block legacy authentication outright. This maps directly to the Cyber Essentials user access control requirements.
- Audit OAuth apps and service principals. Review which applications hold mail, file or directory permissions, remove anything unused, and restrict user consent to verified publishers.
- Prepare a token revocation playbook. Know how to revoke all sessions, reset credentials and rotate app secrets quickly; a password reset alone does not end an active session.
- Know where personal data sits. Map what lives in mailboxes and SharePoint so a breach assessment, and any ICO notification, can be made within 72 hours.
- Brief staff and customers on follow-on phishing. After any mail compromise, expect convincing lures that reuse real threads. Remind people you will never ask for passwords by email, text or phone.
Bottom line
Gibraltar’s incident is a reminder that a cloud email tenant is a crown-jewel system, and that relying on your provider to spot intruders is a gamble. The territory kept its core registers separate and worked with the NCSC once alerted, but the period before Microsoft’s warning are the part every UK organisation should worry about. If an attacker were in your Microsoft 365 estate today, would you be the first to know?
Sources
- GBC News: There have been attempts to hack the Government’s IT cloud system, Government confirms
- Gibraltar Chronicle: Govt says cyber security incident contained as investigation continues
- The Olive Press: Fears hackers have extracted sensitive data from Gibraltar government servers after gaining access ‘for weeks’
