Skip to main content
FOI release

Request for information on cyber security breaches

Published 13 May 2026

© Crown copyright 2026

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/foi-request-cyber-security-breaches/request-for-information-on-cyber-security-breaches

7th Floor, The Cabot
25 Cabot Square
London E14 4QZ
T: +44 (0)20 7215 6537
E: Enquiries@GroceriesCode.gov.uk
www.gov.uk/gca

Sent by email

5 May 2026

Freedom of Information Act: Request for information on Groceries Code Adjudicator (GCA) activities

Thank you for your email of 4 April 2026 regarding cyber security breaches and the GCA. You asked for the following information for each calendar year from 2020 to 2026 inclusive:

  1. The number of cyber security breaches identified as resulting from a malicious threat actor (i.e. not accidental data breaches).

  2. A breakdown of the high-level causes of these breaches as identified by cyber security incident response teams (CSIRTs).

  3. The number of breaches attributed to a previously known vulnerability in the organisation’s hardware, software, policies or processes.

  4. The estimated combined costs incurred as a result of cyber security breaches defined in point 1 for each year.

General right of access to information held by public authorities

Under section 1(1) of the Freedom of Information Act 2000, anyone making a request for information to the GCA, as a public authority, is entitled to be informed in writing whether it holds that information, and if so, to be supplied with it.

The GCA does not hold the information you have requested.

The GCA’s IT services, including cyber security services, are provided by the Department for Business and Trade (DBT) and Integrated Corporate Services (ICS), a shared corporate service established by the Department for Energy Security & Net Zero and the Department for Science, Innovation & Technology. The type of information you have requested may be held, where it exists, by those organisations rather than by the GCA. You may therefore wish to direct your request to DBT (FOI@businessandtrade.gov.uk) and ICS (foi.requests@energysecurity.gov.uk).

Appeals Procedure

If you wish to complain about the way in which your request for information has been handled, you may seek an internal review by writing, setting out the reasons you feel your request has not been dealt with effectively, to:

The FOI Review Co-ordinator
Groceries Code Adjudicator
7th Floor, 25 Cabot Square
London
E14 4QZ

Alternatively, you can email: enquiries@groceriescode.gov.uk.

We will aim to deal with your internal review request within 20 working days of receipt or, if that is not possible, advise you of a date when we expect to complete the review.

If you are dissatisfied with the outcome of the internal review, you then have the right to appeal to the Information Commissioner’s Office. You can do this on the Information Commissioner’s Office website.

Back to top