A recent investigation revealed that the premature release of confidential information from Rachel Reeves’s Budget was due to IT vulnerabilities, not deliberate disclosure. The Office for Budget Responsibility (OBR) described the incident as the most significant failure in its 15-year history. Following the unintentional early upload of official forecasts to its website, the OBR conducted an inquiry in collaboration with cybersecurity expert Professor Ciaran Martin.
Budget details are typically closely guarded due to their market sensitivity, with the Chancellor only becoming aware of the breach moments before her speech in the Commons. The investigation determined that the incident was not a result of malicious cyber activities or human error but stemmed from two technical flaws associated with the WordPress publishing platform utilized by the OBR.
Interestingly, it was discovered that a similar premature leak occurred before the Chancellor’s Spring Statement in March, though no immediate action was taken as it was deemed non-malicious. The investigation revealed that the sensitive document was accessible online from 11:30 to 12:08, during which it was viewed 43 times by 32 different IP addresses.
Treasury minister James Murray characterized the incident as a grave breach of highly confidential information and emphasized the need for immediate corrective actions. He expressed concerns about the existing vulnerabilities and the potential impact on market behavior due to early access to sensitive data.
In response to the findings, the OBR acknowledged the severity of the situation and issued apologies for the disruption caused to the Chancellor. The report recommended a thorough review of the organization’s document publication processes to enhance transparency and prevent future occurrences of premature disclosures.
