Government’s recent cyber incident involved the same cloud tools used every day by businesses across Gibraltar. We do not yet know the full extent of what happened, but there is enough here to prompt a useful check of our own systems.

Microsoft Outlook, Teams, SharePoint and OneDrive sit quietly behind much of office life. They hold emails, documents, conversations and sometimes years of commercially sensitive information, which makes them extremely useful and, inevitably, attractive targets.

HM Government of Gibraltar confirmed this week that an unauthorised party had gained access to elements of its cloud environment. Microsoft alerted Government to the potential breach, after which Gibraltar’s IT team worked with Microsoft and specialists coordinated through the UK National Cyber Security Centre to contain the incident and investigate what happened.

Government says its main databases containing residents’ personal records are stored separately and were not affected. A forensic investigation is still establishing whether information within the cloud environment was accessed or extracted, so there is little value in speculating about what happened beyond the facts currently available.

For businesses, the question is how confident we are about the cloud environments we use ourselves.

The cloud still belongs to you

Moving email and documents into Microsoft 365 or Google Workspace solves plenty of technology problems, but it does not remove responsibility for how accounts are configured, who has access or what happens when somebody gets in who should not. For many small companies, an email account is effectively a key to the business. It can provide access to customer correspondence, invoices, contracts, cloud storage and the names of people who are trusted enough to approve payments.

That can also make a compromised account particularly convincing as a tool for fraud. A request to change bank details carries much more weight when it appears inside a genuine email conversation rather than arriving from an obviously suspicious address.

The wider fraud picture in Gibraltar reinforces the point. RGP figures provided to the GFSC show cyber-related fraud accounting for 78% of fraud reported so far in 2026, compared with 64% in 2023.

Check who can get in

Most businesses do not need sophisticated cyber-security infrastructure to improve their position. They do need a clear picture of who can access what.

Multi-factor authentication should be active on important accounts, particularly email and administrator logins. Former employees and contractors should not retain access because nobody remembered to remove it, while administrator privileges should sit with people who genuinely need them.

It is also worth reviewing what those accounts can reach. Shared drives and cloud folders tend to grow organically. Permissions get added for a project and remain long after it ends. Files that started in one person’s working folder become repositories for customer information, finance records or HR documents.

A simple access review can quickly reveal whether too many people can see sensitive material or whether a compromised account would open considerably more of the business than expected.

Fraud does not always look suspicious

Government’s advice following the incident includes using strong, unique passwords, enabling multi-factor authentication and being cautious about unexpected emails, messages and calls.

The difficult part is that increasingly sophisticated fraud does not always look unexpected.

A real account can be used to continue an existing conversation. Artificial intelligence is making convincing text, voice and image impersonation easier, while the GFSC’s current World Investor Week campaign is specifically warning about digital deception and the growing realism of scams.

Businesses therefore need checks that operate independently of the message itself. A request to change payment details might require a phone call to a known number. A large transfer could need approval from somebody else. Staff should know that questioning an unusual instruction is expected rather than awkward.

These are simple controls, but they become valuable when the email requesting the money looks completely legitimate.

Know what you would do

Many smaller businesses have good security tools but a much less developed answer to what happens after an incident.

If an account were compromised tomorrow, who could disable it? Who would contact the IT provider? Where are the backups? Which clients might need telling? Does anybody have the passwords or contact numbers needed if the usual systems are unavailable?

A useful response plan does not have to fill a folder. For a small organisation, one page containing the right contacts and the first actions to take may be more valuable than a lengthy policy nobody remembers exists.

Government had Microsoft, the NCSC and specialist cyber teams available during its response. Most Gibraltar SMEs will have fewer resources, which makes knowing who to call and what to shut down particularly important.

A useful ten-minute check

There is no suggestion that Government’s incident tells us anything specific about the security of another organisation’s Microsoft or Google environment. It does, however, provide a very local reminder of how much information now sits behind everyday cloud accounts.

Businesses could use that reminder to check three fairly basic things: whether multi-factor authentication is active, who currently has administrator access and whether staff know how to respond to a suspicious request coming from an otherwise trusted account.

Source Links
Government confirms cyber security incident contained following extensive security measures
GFSC urges public to ‘stop and think before acting’ amid rise in cyber fraud
National Cyber Security Centre