FOI docs: UK's antitrust regulator suffered 150 data breaches in the last two years, including 40 lost or stolen devices, as hackers seek sensitive company docs
- CMA handles sensitive information on takeovers, competition — Declines to say if breaches affected any merger situations
Context & Ripple Effects
The CMA sits on some of the most commercially sensitive paperwork in Britain — takeover filings, competition case evidence — and FOI documents now show it lost control of that material repeatedly: 150 breaches in two years, 40 of them lost or stolen devices, with hackers specifically targeting company documents. The authority declines to say whether any live merger situations were touched, which leaves every party currently filing with it guessing.
The disclosure lands awkwardly for a regulator mid-expansion: the CMA is enforcing new bans on hidden fees and fake reviews, weighing a potential block of Getty's proposed Shutterstock deal, and operating under an interim chair, Doug Gurr, after its previous chair was forced to resign. It also fits a long UK pattern — [[a:933091|breaches reported to the ICO were seven times more likely to stem from human error than hacking]], and the regulator's own enforcement record runs from the £400K Carphone Warehouse fine to the British Airways penalty cut from £184M to £20M.
First-order effects
- Companies with live CMA cases — merger parties and competition defendants — now face uncertainty about whether their confidential submissions were among the compromised material, since the CMA refuses to confirm or deny exposure of specific situations.
- The CMA must defend its own security posture at the same time it exercises newly enhanced powers, handing every investigated firm a ready-made argument about the regulator's competence.
Second-order effects
- The ICO, which has fined companies from Carphone Warehouse to British Airways for preventable breaches, faces pressure to apply the same standard to a fellow regulator — an awkward enforcement test inside UK government.
- Rival authorities and overseas antitrust agencies receiving CMA-shared intelligence may tighten information-handling conditions, raising friction in cross-border merger cooperation.
Third-order effects
- If breach-prone handling persists while the CMA's remit grows, the structural question becomes whether the UK's enforcement apparatus needs dedicated security oversight and mandatory disclosure standards for regulators themselves, not just the firms they police.
- Confidentiality is the currency of merger review; repeated leaks would push companies toward more guarded filings, degrading the quality of evidence the CMA depends on — a slow erosion rather than a single event.
The trend: UK regulators are accumulating enforcement power faster than they are hardening their own data security, and FOI disclosures are forcing that gap into the open.