UK Government Investments: 51 staff exposed — asset inventory is decisive

On 2 August 2026, UK Government Investments acknowledged an internal file exposed the names and work emails of 51 officials for ~40 hours. Here is the asset inventory/CMDB approach that operationalizes NIS 2 Art. 21 and prevents this type of leak.

What happened

On 2 August 2026, the UK public agency UK Government Investments (UKGI) stated that “an internal file containing management information and the names/work email addresses of 51 staff” was publicly accessible for around 40 hours. The cause was not a sophisticated hack but human error: an employee failed to follow internal rules, making an internal document accessible from outside. The incident was identified in the past fiscal year and notified to the national regulator (ICO). Source: The Guardian (02/08/2026).

Verified key points:

• Organization: UK Government Investments (UKGI).
• When: ~40 hours exposure, disclosed 2 August 2026.
• Scope: 51 staff (names and work emails).
• Mechanism: internal file made public due to a breach of internal policies (publishing/sharing error).

This “small” incident reflects a European reality: the most frequent leaks do not always stem from ransomware, but from poorly inventoried assets and misconfigured sharing (public link, misconfigured cloud bucket, “guest” folder, anonymous wiki). Without a reliable inventory of information assets and exposure surfaces, preventing or quickly detecting such errors is difficult.

Applicable legal framework

For organizations established in the EU (and groups operating in Luxembourg/Belgium/France/Germany), two frameworks require concrete, documented measures:

• NIS 2 — Article 21: “essential” and “important” entities must implement cyber risk management measures, including security of assets and the supply chain and proportionate technical and organizational controls. Official text: Directive (EU) 2022/2555 (Art. 21). See also our overview of the NIS 2 directive and its requirements.
• GDPR — Article 32: obligation to ensure a security level appropriate to the risk to prevent, among others, unauthorized disclosure. Reference: EUR‑Lex — GDPR Art. 32; local reminder by CNPD: CNPD — Security of processing. For more context, see our page on GDPR and security of processing.
• ISO/IEC 27001/27002: ISO/IEC 27002:2022 control 5.9 mandates an inventory of information and associated assets; this is the cornerstone of a usable CMDB. Ref.: ISO/IEC JTC 1/SC27 (control 5.9).

Operational translation: be able to prove you know which assets (data, cloud repositories, shares, wikis, collaboration spaces, APIs, backups) exist, where they reside, who accesses them, under which sharing policies, and how a change (e.g., switching to a public link) triggers automatic controls.

The technical solution: Usable asset inventory and CMDB

The asset inventory and CMDB is not just a list of devices. To address “exposure-driven” leaks, the CMDB must cover information assets and publishing/sharing surfaces with dynamic linkages:

• Automated, continuous discovery: connectors into M365/SharePoint/OneDrive, Google Workspace, Slack/Teams, wikis (Confluence/Notion), code repos (GitHub/GitLab), S3 buckets, data lakes, public portals; enumeration of spaces and sharing metadata.
• Data classification and labeling: rules (keywords, templates, regex, dictionaries) and/or assisted AI to detect personal/customer data, financial, HR, legal documents; label propagation to platforms.
• Sharing guardrails: real-time block/alert when switching to “Public/Anyone with the link,” or when creating an unapproved external guest; approval workflows (expirations, designated owners, justification).
• Traceability and accountability: each asset has an owner in the CMDB; drift alerts (orphaned data, unjustified public links, repos without owners, APIs without access limits).
• Complementary measures: DLP/CASB integration for content inspection and remediation; IaC drift detection for cloud resources; just-in-time access to reduce persistent exposure.

Standards and frameworks:

• ISO/IEC 27001:2022 Annex A (5.9) — information and asset inventory; A.8 — access management; A.5 — governance.
• NIST CSF 2.0: Identify (ID.AM), Protect (PR.DS, PR.AC), Detect (DE.CM).
• CIS Controls v8: IG1 Controls 1–3 (hardware/software inventory; data management), Control 14 (DLP).

Expected outcome: when a user attempts to publish an internal file “to everyone,” the connector raises the event, the CMDB knows the data type, the policy blocks or requires approval, and an automated ticket notifies the owner. In parallel, the SOC receives a correlated alert (source, content, context) for action if needed.

How Luxgap deploys this

• Our ISO 27001 governance: scoping information assets, CMDB data model, sharing policies and responsibilities; our Lead Implementer/Auditor structures the repository (owner roles, classification rules, evidence registers) to meet ISO A.5.9 and demonstrate NIS 2 Art. 21.
• Our 24/7 managed SOC: ingestion of M365/Google/Confluence/GitHub/S3 logs; detection of public links, guest creations, ownerless repos; remediation playbooks (share revocation, automatic expiry, owner assignment) and notifications to DPO/CISO. Learn more about our managed SOC and incident detection.
• Our outsourced DPO and CISO consultants: align security policies with GDPR Art. 32 (CNPD) and prepare evidence (sensitive asset register, access matrix, control proofs) in audits or incidents; see how a certified DPO mandate is structured.

Practically, we start by inventorying “data zones” (collaboration, code, object storage, data warehouse), wiring connectors, defining the classification dictionary (personal, financial, HR, secrets), then enabling progressive policies (detect → alert → block) to avoid business disruption.

Real-world case in Luxembourg or the EU

A B2B services entity under NIS 2 (presence in Luxembourg, M365 + Confluence + S3) deployed in 6 weeks an automated inventory/CMDB covering 12,000 spaces and 3 PB of objects. Measured results in Q1:

• Removal/closure of 1,180 unjustified “Anyone with the link” shares (including 9 with customer data).
• 73% reduction of “orphaned” spaces via owner assignment and archiving.
• Automatic blocking of new public shares for 4 “sensitive” document types; exceptions via workflow (max 30 days, justification and traceability).

These elements were added to the compliance dossier (evidence for ISO 27001 A.5.9, NIS 2 Art. 21) and to the GDPR Art. 32 file supporting the DPO.

First concrete steps

1. Map your “data zones”: M365/Google, wikis, code, S3/Blob, no‑code tools. List available connectors and exploitable sharing metadata.
2. Assign data owners by domain (Finance, HR, Legal, Sales) and link each space to an owner in the CMDB.
3. Define a minimal classification dictionary (personal/customer, internal secret, public) with templates detecting personal and financial data.
4. Enable “soft” guardrails: alert on any “Public/Anyone” sharing; require a reason and a duration (default expiry 14 days) before enforcing blocks.
5. Wire up monitoring: forward sharing events to the SIEM/SOC; test a remediation playbook (remove public link + notify owner + ticket).

Official sources

• News item: The Guardian — UKGI data breach (02/08/2026).
• NIS 2 — Article 21: EUR‑Lex — Directive (EU) 2022/2555.
• GDPR — Article 32: EUR‑Lex — Regulation (EU) 2016/679 and local CNPD reminder: CNPD — Security of processing.
• ISO/IEC 27002:2022 — control 5.9 (information and asset inventory): ISO/IEC JTC 1/SC27 Journal.

Get in touch to scope a 4–6 week CMDB pilot focused on “sharing surfaces.”