The insider threat: lessons from the GCHQ personal data breach

A screenshot from a news report on the GCHQ breach.

The recent revelation of a former GCHQ intern unlawfully accessing and removing classified data, including the names of intelligence officers (1), is not just a breach of national security - it’s a wake-up call to every organisation handling sensitive or personal data. It reinforces a stark truth: no organisation is immune to insider threats.

This particular incident, now the subject of a legal case under the Computer Misuse Act 1990, described actions that were unauthorised, intentional or reckless, and carried the potential to seriously damage national security (2). Although the charge doesn’t sit under data protection legislation, it could meet the threshold of an offence under Section 170 of the Data Protection Act 2018, which addresses obtaining personal data without the controller’s permission.

But legal statutes aside, what truly resonates is the human cost of such breaches. These weren’t just names on a spreadsheet - they were real people, fulfilling roles that rely on confidentiality for their own protection and national safety. When data is compromised, so too is trust. And trust, once broken, is difficult to repair.

Not an anomaly - but a pattern

While this case has gained media attention, it is far from isolated. The NPSA Insider Data Collection Study (2013) (3) highlighted that a staggering 76% of insider threat incidents were self-initiated. These weren’t spies in disguise - they were employees or interns who identified exploitable gaps. Only 6% were premeditated infiltrations.

This distinction matters: insider threats often emerge from within the organisation, not from outside actors with dramatic motives. Complacency, unmet needs, financial pressure, or a lack of oversight can quietly unlock doors that should remain shut.

From awareness to action

Here’s a five-step framework any organisation can adopt to get started:

1. Identify your information assets. Map out what data you hold. Classify your most critical assets - the ones you couldn’t function without - and understand who has access.

   
   

2. Understand the threat landscape. Consider the value of each asset. What might make it appealing to exploit? Is there a financial, reputational, or political incentive? Are there vulnerabilities in staffing or culture?

   
   

3. Conduct risk assessments. Examine likelihood and impact. Could a disgruntled employee export sensitive files? Could a temporary staff member access data they shouldn’t?

   
   

4. Reflect insider risk on your risk register. Document existing personnel security measures, from access controls to vetting procedures. Then ask: Where are the gaps? What enhancements - policy updates, cultural interventions, systems upgrades - might close them?

   
   

5. Prioritise and act. Not all risks are equal. Focus on the most significant threats and introduce proportionate mitigations. Whether that means leadership buy-in, targeted training, or anonymous reporting channels, proactive efforts matter.

   
   

   The question we need to be asking isn’t “Could this happen to us?” - it’s “What are we doing to stop it from happening?”

   
   

   This is about people, not just protocols

   At its core, insider risk management isn’t just a compliance exercise - it’s a culture shift. It’s about embedding vigilance and accountability into the fabric of organisational life, creating an environment where safeguarding data is everyone’s responsibility.

   
   

   Because behind every file is a human being. And our job as consultants, strategists, or custodians of data protection isn’t just to draft policies - it’s to protect people.

   
   

   So, ask yourself: What steps are you taking to protect your data - and the people behind it?

   
   

   We’re here to help you turn concern into capability.

References

(1) Gawne, E., (2025). BBC News, Former GCHQ intern admits taking top secret data home - BBC News. Available at: https://www.bbc.co.uk/news/articles/c5y6933pp9go . (Accessed 1 April 2025).

(2) Al-Othman, H., (2025). The Guardian, Ex-GCHQ intern admits risking national security with data breach. Available at: https://www.theguardian.com/uk-news/2025/mar/31/ex-gchq-intern-admits-risking-national-security-with-data-breach. (Accessed 1 April 2025).

(3) National Protective Security Agency, (2013). NPSA INSIDER DATA COLLECTION STUDY - Report of Main Findings. Available at: https://www.npsa.gov.uk/resources/insider-data-collection-study-report-main-findings. (Accessed 1 April 2025).