The Budget watchdog has committed to providing swift answers by enlisting a top cybersecurity specialist to conduct an expedited investigation into the recent budget leak embarrassment.
Insiders have revealed that a straightforward publishing mistake is believed to have caused the fiasco, with all evidence suggesting it was a blunder rather than a deliberate act, sources informed the Mail.
This discovery intensifies the scrutiny on the Office for Budget Responsibility (OBR), which is racing against time to clarify the mishap by its self-imposed deadline of Monday.
Given the sensitive nature of market-related information, Budget details are intended to remain confidential until the Chancellor officially presents them in the House of Commons.
However, it seems that an early-access PDF of the OBR’s crucial forecast was inadvertently made available by altering the web address from ‘March’ to ‘November’ in an earlier version.
As a result, the report, scheduled for release following Rachel Reeves’ speech, was prematurely downloadable through an unsecured link an hour before her formal announcement.
OBR Chairman Richard Hughes, who has not ruled out resigning over the embarrassing error, admitted he was ‘personally mortified by what happened’.
He said a swift investigation has been launched with the input of Ciaran Martin, the former head of the National Cyber Security Council.
Leading expert Ciaran Martin, the former head of the National Cyber Security Council, has been drafted in for a rapid investigation into the budget leak
OBR Chairman Richard Hughes, who has not ruled out resigning over the embarrassing error, admitted he was ‘personally mortified by what happened’
Rachel Reeves said she retains confidence in Mr Hughes despite the leak, which she said ‘must never happen again’
‘A link to our EFO document was inadvertently made accessible to the public prior to the conclusion of the chancellor’s statement when it is usually published.
‘It wasn’t published on our website but there was a link that somebody managed to find and that made it accessible and it was then disseminated.
‘As soon as it was discovered we took action to take it down.’
Whitehall sources told the Mail the decision to bring in the former cybersecurity chief was an indication of how rattled OBR bosses were as there has been no evidence of a cyber hack.
It is thought that the leading expert was hurriedly drafted in to highlight that the OBR recognises the gravity of the issue.
But insiders predicted the move may backfire when Mr Martin discovers that it was a simple security loophole on their own systems.
There has also been bemusement at the decision not to enlist the help of the National Cyber Security Centre (NCSC), the independent authority on critical cyber incidents affecting the UK.
Mr Martin, who founded the NCSC before leaving in 2020, now carries out cybersecurity advisory work for the private and public sector.
He charges as much $10,000 (£7,500) for virtual engagements and as much as $20,000 (£15,000) for in-person events the US, according to a New York based key-note speakers agency website.
Of the investigation, Mr Hughes said: ‘We will look into how this happened, we will identify actions required to ensure it doesn’t happen again, we’ll implement those recommendations in full.
‘I’m personally mortified by what happened, we take budget security incredibly seriously, which is why an investigation is already under way and will report very swiftly by early next week.’
He said he had written to the chancellor, and the chair of the treasury select committee ‘to apologise and take full responsibility’ for the mistake.
‘Personally, I serve day to day subject to the confidence of the chancellor and the treasury committee.
‘If they both conclude in light of that investigation, they no longer have confidence in me then of course I will resign….’
The unprecedented error meant key details from the budget – on taxes, economic growth and individual policy changes – were all reported an hour before the budget was delivered to parliament.
It sparked anger across Westminster, frenzy on trading room floors and caused turmoil on the financial markets.
It is understood that the Financial Conduct Authority (FCA) is set to review the findings of the OBR’s investigation due to the spell of volatility caused.
Ms Reeves said she retains confidence in Mr Hughes despite the leak, which she said ‘must never happen again’.
But acknowledged her anger was at the ‘higher end’ of the scale when she found out about it while in the Commons Chamber ahead of the Budget.
The Chancellor told Sky News: ‘Richard Hughes wrote to me yesterday evening, apologising for their error. It was a serious error, a serious breach.
‘They have announced an investigation which will report to me very quickly.
‘But I do have confidence in Richard and the OBR. They do important work. But what happened yesterday, it did let me down, and it shouldn’t have happened, and it must never happen again.’
A spokesperson for the OBR confirmed there was no reason to believe the leak was the result of a hack.
‘The OBR inadvertently made it possible to access the November 2025 Economic and fiscal outlook (EFO) too early on Budget day.
‘It has launched an investigation into what happened which will report publicly no later than Monday 1 December,’ they added.
