Breaches and incidents
GCHQ (UK): “thousands” of removable storage devices unaccounted for, IPCO annual report
The Investigatory Powers Commissioner’s annual report for 2025 says GCHQ cannot immediately locate a “very significant number” of removable media items...
- Disclosed
- Verification
- Checked against a primary source
What happened
- The Investigatory Powers Commissioner’s annual report for 2025 says GCHQ cannot immediately locate a “very significant number” of removable media items (USB sticks, external hard drives, CDs, memory cards), which GCHQ “currently estimate to be in the thousands”, some of which may contain Investigatory Powers Act data. The issue was first reported in IPCO’s 2024 report; the “thousands” scale estimate is new in this report (published on a Thursday, per The Record on 30 Oct).
- Root cause: per IPCO, GCHQ lacked a sufficiently clear understanding of the scale, location and recoverability of lost removable media; GCHQ told The Record its removable media tracking system was previously not robust enough.
- No attacker named. The report does not allege any device reached adversaries, and GCHQ declined to say whether it knew of unauthorized access (per The Record).
- IPCO says it is “very concerned” and “disappointed with the time it has taken GCHQ to investigate”; GCHQ has commissioned a new removable-media monitoring tool for use in 2026 and must send IPCO regular written progress reports.