An “external person” may have been able to access the Office for Budget Responsibility’s (OBR) assessment of Rachel Reeves’ Budget, but its early release is not thought to have been a cyber attack.
The Economic and Fiscal Outlook (EFO) document appeared online more than half an hour before the Chancellor delivered her budget, a significant blunder that prompted an immediate investigation by OBR chair Richard Hughes.
Mr Hughes, who has enlisted a cyber security expert to look into the incident, stated he would be prepared to resign should he lose the confidence of the Chancellor and the Treasury Committee.
The OBR said at this stage there was no reason to believe there was a cyber attack which led to the disclosure of the document, which would normally not be published until the Chancellor had concluded her Budget statement.
Mr Hughes said he was “mortified” by the situation, telling a Resolution Foundation event: “A link to our EFO document was inadvertently made accessible to the public prior to the conclusion of the Chancellor’s statement when it is usually published.
“It wasn’t published on our website, but there was a link that somebody managed to find, and that made it accessible, and then it was then disseminated. As soon as it was discovered, we took action to take it down.”
Mr Hughes has written to the Chancellor and Commons Treasury Committee chair Dame Meg Hillier to apologise and to take “full responsibility for what has happened”.
An investigation has been launched, with expert input from Professor Ciaran Martin, the former head of the National Cyber Security Centre (NCSC), which will “identify actions required to ensure it doesn’t happen again”.
Mr Hughes said: “I’m personally mortified by what happened. We take budget security incredibly seriously, which is why this investigation is already under way and will report very swiftly by early next week.
“Personally, I serve day-to-day subject to the confidence of the Chancellor and the Treasury Committee. If they both conclude, in light of that investigation, they no longer have confidence in me then, of course, I will resign, which is what you do when you’re the chair of something called the Office for Budget Responsibility.”
The NCSC is not currently investigating the circumstances surrounding the release of the report and, asked whether Mr Hughes was suggesting there could have been a cyber attack, the OBR said they “have not reason to believe that is the case”.
The OBR previously said a “technical error” within the organisation was to blame for the early release of the document.
Ms Reeves said she retains confidence in Mr Hughes despite the leak, which she said “must never happen again”, but acknowledged her anger was at the “higher end” of the scale when she found out about it while in the Commons Chamber ahead of the Budget.
The Chancellor told Sky News: “Richard Hughes wrote to me yesterday evening, apologising for their error. It was a serious error, a serious breach.
“They have announced an investigation which will report to me very quickly.
“But I do have confidence in Richard and the OBR. They do important work. But what happened yesterday, it did let me down, and it shouldn’t have happened, and it must never happen again.”
Asked how angry she was, she told LBC Radio it was “at the higher end” of a one-to-10 scale.
Meanwhile, chair of Parliament’s Treasury Committee Dame Meg Hillier wrote to Mr Hughes about a passage in the watchdog’s document stating he had written her a letter about the forecast, which she says she has not received.
The foreword to the OBR’s forecast had said: “Given the unusual volume of speculation on the subject prior to the publication of this EFO, the Chair has taken the unusual step of writing to the Chair of the Commons Treasury Committee to set out the facts concerning the evolution of our forecast over the course of the past four months.
“A copy of this letter is available on our website.”
In a letter to Mr Hughes on Thursday, Dame Meg said: “The foreword to your recent Economic and Fiscal Outlook referred to a letter that was to be sent by you to me to ‘set out the facts concerning the evolution of your forecast over the course of the past four months’.
“I have not received that letter. Please can you send me a copy of that letter as soon as possible, in the form it was originally intended.
“In line with the Committee’s usual practice, I will be placing this letter, and in due course your response, in the public domain.”
