On 9th March 2021 the Higher Statistical Officer in the TB Stats Team was testing the procedures for the updating of the interactive dashboard that sits alongside the National Statistics release. The final step in the process was completed which meant that the Q4 data went live at 15:22. This was 18 hours before the pre-announced release time. He immediately alerted the lead statistician and changed the data back to the Q3 2020 version at 15:30. The statistics were live for a period of approximately 8 minutes.

We are unable to assess whether any users of the interactive dashboard were accessing the page at the time when the breach occurred. It is unlikely any users would have attempted to access the data at this time, as more up-to-date values were due to become available the following day. As of 17 March no users have contacted us to inform us of the breach. No evidence of further dissemination of the statistics in advance has been found.

Users who were already viewing the dashboard at the time of the breach would have seen the new data had they manually refreshed the page, but not if they had just interacted with the dashboard normally. Similarly, any user who accessed the dashboard during the 8-minute window would have been able to see the new data, provided they did not manually refresh the page after 15:30.

The complete release would not have been available to view and none of the statistical commentary is included in the dashboard. The data cannot be downloaded from the dashboard, and any user wishing to retain the data would have had to manually copy it.

We will urgently investigate creating a test URL to check that the data updates process functions as expected. It would be inaccessible to unauthorised users.

We will refine the instructions and training for the quarterly process to make sure that for future updates (next due June) the final step is not completed before the National Statistics release is confirmed to be live.