New Detail Published on How Last Year’s Budget Leak Unfolded

The government has now published its Review into the 2025 Autumn Budget leak, explaining how the Office for Budget Responsibility’s Economic and Fiscal Outlook (EFO) was accessible online an hour before the Chancellor was due to speak.

The Review sets out measures that will be taken to prevent this from happening again.

What actually happened?

The Review incorporates findings from the National Cyber Security Centre’s investigation, which found that the leak was a result of repeated attempts to access the webpage holding the EFO, rather than a hostile cyber-attack.

The fault lay in a misconfiguration in the way that the OBR’s website was set up. This meant that the webpage holding the report was accessible earlier than the OBR intended. Users who guessed the webpage address correctly based on previous reports were able to access the report.

The investigation found that around 520 of the 534 early access attempts were linked to just four IP addresses from the same internet provider. Investigators believe it is reasonable to assume this was the same individual or organisation.

The one or more individuals who secured early access seem to have then used social media and messaging apps to spread word of the early access. In all, the EFO was downloaded 24,701 times before the mistake was noticed.

What is changing?

The OBR is due to publish an EFO at the time of the Spring Forecast announcement on 3 March 2026. Historically, the OBR has published these reports on its own website rather than a government website in order to maintain its independence.

However, because of the sensitivity of the information contained in the EFO, it will be published on GOV.UK by HM Treasury. HM Treasury has commented that doing this will not give it access to any information ahead of time of which it is not already aware.

For future EFO and other market-sensitive publication releases, it is planned that OBR will move to using GOV.UK.

In readiness for the 2026 Budget, likely to be held in the autumn, there are plans to bring in other internal measures that will enhance security and limit data access.

To read the Budget Information Security Review in full, see: https://www.gov.uk/government/publications/budget-information-security-review 

Looking for advice? Check out our full range of services. From payroll help to taxation advice, our expert team is available to lend a hand.