The Government Digital Service (GDS) has awarded two major contracts totaling approximately £17.5 million to bolster the cybersecurity and technical resilience of the GOV.UK One Login digital identity platform. The funding includes £10 million for cybersecurity services provided by Accenture and £8 million for technical architecture support from PA Consulting.
Security Revamp Follows Certification Loss and System Flaws
This investment comes as GDS works to recover from recent security setbacks. In late May, the GOV.UK One Login platform lost its Digital Identity and Attributes Trust Framework (DIATF) certification after its biometrics provider, understood to be iProov, failed to maintain the required compliance standards. GDS has since initiated a recertification process and begun implementing corrective measures.
Earlier in the year, a red-team security assessment conducted in March uncovered a critical vulnerability that allowed privileged access to the system without detection. The findings triggered urgent remediation and heightened scrutiny of the platform’s cybersecurity posture.
Further concern emerged following whistleblower allegations reported in April, suggesting that the personal data of roughly three million One Login account holders may be at risk due to unresolved legacy issues. While the full extent of exposure remains under review, the claims have added pressure on GDS to demonstrate that user data is adequately protected.
Expansion Plans Continue Despite Security Concerns
Despite these challenges, the One Login programme continues to expand. Companies House integrated the One Login identity verification service in April 2025, joining other departments already onboard. GDS aims to integrate the system with 100 government services by the end of the year.
The upcoming launch of the GOV.UK Wallet is also a key milestone in the programme. Set for release later in 2025, the Wallet will allow users to store digital credentials—such as veteran ID cards and driver’s licences—on their smartphones. Access to the Wallet will require a One Login account, making secure authentication foundational to its success.
The urgency of these upgrades has been underscored by broader concerns over public-sector cybersecurity. The Legal Aid Agency recently reported a serious cybersecurity breach, first disclosed in May and updated in June, which drew renewed attention to the risks faced by government digital services.
GDS’s dual investment in technical architecture and cybersecurity is intended to reinforce trust in its flagship identity platform and safeguard sensitive user data as the service scales. The progress of the recertification effort and security enhancements will be closely watched by stakeholders across the public and private sectors.
Sources: Public Technology, Think Digital Partners, Gov.uk
—
June 3, 2025 – by Cass Kennedy
