UK One Login Digital ID System Faces Major Security Breach Allegations

The UK Government Digital Service (GDS) is under intense scrutiny following whistleblower allegations that its One Login digital identity system suffers from major cybersecurity and data protection vulnerabilities. The system—now used by approximately three million people and integrated with 50 government services—allegedly exposes user data to serious risks due to critical structural flaws.

The whistleblower, a cybersecurity professional who raised these concerns in July 2022 shortly after the system’s launch, claims One Login lacked basic governance and risk management processes. According to their testimony, system administration was carried out using devices that did not meet compliance standards, increasing the risk of malware infections and phishing attacks. The whistleblower’s data reportedly showed over 500,000 system vulnerabilities, with thousands rated as “critical” or “high” severity.

Among the most serious allegations is the unauthorized outsourcing of development work to Romania. This decision was made without approval from then-GDS CEO Tom Read or consultation with the National Cyber Security Centre (NCSC). Read later expressed concern over this decision. The whistleblower further asserts that the business case used to secure more than £330 million in funding for One Login contained misleading claims about its cybersecurity readiness.

An internal investigation by GDS’s chief information security officer reportedly confirmed key parts of the whistleblower’s claims. The probe found that privileged access controls were poorly managed and that serious vulnerabilities were left unaddressed. Nevertheless, GDS allegedly failed to disclose these findings when questioned by Members of Parliament. A Cabinet Office data protection officer also flagged serious failings in November 2022, citing unauthorized biometric data processing and automated decision-making without informed user consent.

Oversight and transparency issues have compounded concerns. According to reports, GDS suppressed warnings from internal experts and outside entities like the NCSC, and the agency allegedly withheld critical security information from Parliament. Meanwhile, the external consultancy 6point6, which was tasked with providing assurance for One Login, is said to have refused to share key security data with internal GDS teams—raising questions about potential conflicts of interest.

The whistleblower claims they faced disciplinary action after escalating their concerns to a Member of Parliament under the Public Interest Disclosure Act. Additionally, the One Login Inclusion and Privacy Advisory Group, which had provided input on accessibility and privacy issues, was quietly disbanded in early 2025—fueling further criticism about GDS’s commitment to user protections.

Despite the controversy, the Department for Science, Innovation, and Technology (DSIT), which oversees GDS, insists that the system is secure. A DSIT spokesperson stated the agency remains “fully compliant with UK data protection and privacy laws—including UK GDPR and the Data Protection Act 2018,” and that its processes adhere to NCSC guidance.

Calls for expanded digital identity infrastructure are growing louder. Just last month, a new Parliamentary Digital ID Group was formed to provide oversight for initiatives like the Gov.uk digital wallet and digital driving license. Meanwhile, Labour MPs are pushing for a national digital ID system aimed at streamlining access to public services and controlling illegal migration. These initiatives are backed by proposed legislation to enable cross-department data sharing, consolidating over 190 login systems into One Login. However, critics warn that such centralization increases the stakes for cybersecurity, privacy, and transparency failures.

Operational inconsistencies also raise red flags. Compared to other GDS services—such as Gov.uk Notify—One Login reportedly has far more instances of privileged access to its production environment. The discrepancy has been cited by the whistleblower as evidence of systemic mismanagement.

Sources: Computer Weekly, The Independent, Darktrace

—
April 14, 2025 – by Cass Kennedy