Skip to content
Welcome, thoughtbot's Giant Robots listeners!Start here
Cybersecurity: Threats and Defences
3AUG

G7 cyber exercise ends without readout

1 min read
16:08UTC

A GOV.UK update records the G7 Cyber Expert Group's 2026 Cross-Border Coordination Exercise as concluded on or before 31 July. No readout has been published.

TechnologyDeveloping
Key takeaway

The exercise closed with no published scenario, participants or findings.

The G7 Cyber Expert Group's 2026 Cross-Border Coordination Exercise concluded on or before 31 July, according to a GOV.UK update⁠1. The group brings member states' authorities together to coordinate response to cyber incidents that cross national borders, and the exercise is its rehearsal of that coordination. No participant list, no scenario description and no findings have been published.

Silence of this kind is ordinary practice for exercises of this type, since the scenario often models attacks on named sectors and publishing it advertises what the participants believe they cannot yet handle. It does leave the record thin. Cross-border work of the operational kind produces visible results when it lands, as Europol-backed Operation Saffron did in May by pulling 33 servers out of First VPN, an anonymisation service ransomware crews used. An operator in one of the sectors a cross-border scenario would cover has no way to learn which coordination failures the exercise surfaced, or whether the arrangements it depends on in a real incident were tested at all.

Deep Analysis

In plain English

The G7 Cyber Expert Group is a working group where officials from the G7 countries, the US, UK, Canada, France, Germany, Italy and Japan, practise coordinating their response to a major cross-border cyberattack before a real one happens. A government update confirmed their 2026 exercise wrapped up by 31 July, but no summary of what happened during it, or what they learned, has been published. That means there's currently no public detail on what scenario the exercise covered, who took part beyond the group's usual membership, or what gaps it may have found in how these countries would work together during a real incident.

What could happen next?
  • Meaning

    Without a published readout, the exercise's findings cannot inform public assessment of G7 cross-border incident-response readiness; a future release, if one comes, is the thing to watch.

First Reported In

Update #12 · KEV deadlines fell from 14 days to three

GOV.UK· 3 Aug 2026
Read original →
Different Perspectives
Hospital Sírio-Libanês
Hospital Sírio-Libanês
Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.
The Foschini Group
The Foschini Group
The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.
FirstVDS
FirstVDS
FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.
ESET
ESET
ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.
JPCERT/CC
JPCERT/CC
JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.
Cyber Security Agency of Singapore
Cyber Security Agency of Singapore
The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.