--- title: "UK Ransomware Disclosures, Methodology | Firevault" description: "Documented methodology for the Firevault UK Ransomware Tracker. Sources, verification rules, inclusion criteria, and correction policy." lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": "GB" } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "TechArticle", "headline": "UK Ransomware Disclosures, Methodology", "description": "How Firevault sources, verifies, and publishes UK ransomware and major data-breach incidents. Documented methodology for citation by journalists, academics, and Wikipedia editors.", "url": "https://fire-vault.com/research/uk-ransomware-disclosures-methodology", "author": { "@type": "Organization", "name": "Firevault", "url": "https://fire-vault.com" }, "publisher": { "@type": "Organization", "name": "Firevault", "url": "https://fire-vault.com" }, "citation": [ "Information Commissioner's Office (ICO) public breach register", "National Cyber Security Centre (NCSC) advisories", "Companies House public filings", "Verified UK press reporting" ] } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o)[2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) [Home](/)/ [Research](/research/uk-ransomware-tracker)/ Methodology # UK Ransomware Disclosures, Methodology This page documents how Firevault sources, verifies, and publishes the UK Ransomware Tracker. It exists so that journalists, academics, and reference editors can evaluate the dataset's reliability before citing it. ## Inclusion criteria An incident is added to the tracker when all three of the following are satisfied: - The affected organisation has a UK presence (registered office, operating subsidiary, or critical UK service). - The incident is confirmed by the affected organisation, the Information Commissioner's Office, or two independent UK press sources. - The incident involves either ransomware-driven encryption or unauthorised exfiltration of personal or operational data. ## Primary sources Sources are checked in the following order of precedence. Where higher-precedence sources contradict lower ones, the higher source is used and the discrepancy is recorded in the description field. 1. Information Commissioner's Office (ICO) breach register and decision notices. 2. NCSC advisories and joint advisories with international partners. 3. Direct disclosures by the affected organisation (regulatory filings, press releases, customer notifications). 4. Verified UK press reporting from established outlets (BBC, Reuters, FT, The Register, Computer Weekly, ITV, Sky News). 5. Threat-intelligence vendor reports where the underlying evidence is reproducible. ## Verification Each incident requires at least one source from categories 1-3 above, or two independent sources from category 4. Leak-site listings alone are not sufficient for inclusion; they are tracked internally pending corroboration. Records counts are reproduced as disclosed; where a range is published, the lower bound is used. ## Update cadence The dataset is reviewed continuously and re-published quarterly. Records are revised when new authoritative information becomes available; the `updated_at` field reflects the most recent material change. ## Limitations The tracker captures publicly disclosed incidents only. UK organisations are not required to publicly disclose every ransomware event; the true incidence is therefore higher than the tracker shows. The dataset should be read as a lower bound on UK ransomware activity and a representative sample of disclosed incidents, not as a complete census. ## Corrections & contact Corrections, additions, and methodology questions are welcome at [research@fire-vault.com](mailto:research@fire-vault.com). Material corrections are logged with the date of revision. ## Licence The dataset is published under [Creative Commons Attribution 4.0 International (CC BY 4.0)](https://creativecommons.org/licenses/by/4.0/). Reuse is permitted with attribution to _Firevault UK Ransomware Tracker_ and a link to [fire-vault.com/research/uk-ransomware-tracker](/research/uk-ransomware-tracker). Secured by Design Offline by Default [![Firevault - offline secure storage](/assets/logo-white-official-BKfZ19hm.png)](/) The world's first offline secure storage platform for data. Dedicated hardware. Physically disconnected. Online when you need it, offline when you do not. Not Cloud Not HSM Not SaaS Offline by Design Secure by design [ hello@fire-vault.com](mailto:hello@fire-vault.com) United Kingdom Independently certified by [ ![Cyber Essentials Certified](https://fire-vault.com/__l5e/assets-v1/6f8f42a2-89e1-4c20-938f-3f34d30bc90c/cyber-essentials-2026.png) ![Cyber Essentials Plus Certified](https://fire-vault.com/__l5e/assets-v1/8a77bf2c-6711-4762-b093-c4d650153bc9/cyber-essentials-plus-2026.png) ](https://registry.blockmarktech.com/certificates/) ### Stay Updated Security insights, product updates, and threat intelligence delivered to your inbox. Subscribe I agree to receive emails from Firevault. Unsubscribe anytime. ### Products Data Protection & Storage [ ![Offline Secure Storage product icon](/assets/vault-icon-BhL4-R9F.svg) Offline Secure Storage® (#OSS) A Digital Safe Deposit Box ](/offline-secure-storage) Network Evolution & Rapid Protection (#NEARP) [ ![Control product icon](/assets/control-icon-B9EWHzCT.png) Control Data Path Governance ](/control)[ ![Firebreak product icon](/assets/firebreak-icon-7zSCkB1t.png) Firebreak Physical Network Segmentation ](/firebreak) ### Firevault - [Offline Secure Storage® (#OSS)](/offline-secure-storage) - [LUV](/luv) - [Vault](/vault) - [Why OSS](/why-oss) - [Meet Firevault](/about) ### Solutions - [Keep Personal Data Secure](/oss-for-personal-records) - [Keep Customer Data Secure](/oss-for-customer-data) - [Keep Critical Data Beyond Ransomware](/oss-for-ransomware-recovery) - [Protect Director Data from Fines & Liability](/oss-for-directors-and-boards) - [Secure the Data Your Business Depends On](/oss-for-business) - [Keep Intellectual Property Secure](/oss-for-intellectual-property) - [OSS Use Cases](/oss-for-use-cases) - [Compliance & Risk](/compliance) - [Network Evolution & Rapid Protection (#NEARP)](/solutions/control) ### Resources - [Firevault Playbooks](/playbooks) - [The Leaders' Playbook](/playbook/leaders) - [Firebreak for Water Playbook](/playbook/firebreak-water) - [A Control Blueprint for AI](/playbook/ai-control-blueprints) - [Knowledge Vault](/learn/knowledge) - [White papers](/learn/whitepapers) - [How OSS Works](/how-oss-works) - [How OSS Physical Disconnection Works](/offline-secure-storage/what-is-oss) ### Company - [Press and Media](/press-media) - [Knowledge Vault](/learn/knowledge) - [FAQs](/learn/faq) - [Help Centre](/help) - [Careers](/careers) - [Invest in Firevault](/investors) [](https://www.linkedin.com/company/firevault-limited)[](https://www.facebook.com/profile.php?id=61581962517246)[](https://twitter.com/firevaultuk)[](/rss.xml) Firevault - Disconnect to Protect® [Site Map](/sitemap)● [Privacy Charter](/privacy-charter)● [Terms of Service](/terms)● [Planet Pledge](/planet-pledge)● [Vault User Commitment](/vault-commitment)● [LUV User Commitment](/luv-commitment)● [Cookie Policy](/cookies) © 2026 Firevault Limited Company No. 16320803 · VAT No. 490 8551 64 · Registered in England and Wales