Advancing UK Aerospace, Defence, Security & Space Solutions Worldwide
  • Home
  • /
  • Security
  • /
  • NCSC marks 20th anniversary of first response to state-sponsored cyber attack

Security

NCSC marks 20th anniversary of first response to state-sponsored cyber attack

The National Cyber Security Centre (NCSC) has marked the 20th anniversary of GCHQ’s first response to a cyber attack perpetrated against the UK Government by another state, with the response acting as the forerunner to a capability that became the National Cyber Security Centre, a part of GCHQ.

Above: The National Cyber Security Centre (NCSC), Nova South, London.
Image by Simone Flamigni / copyright Shutterstock

In June 2003, GCHQ experts were involved in responding to a cyber attack against the UK Government for the first time. Unlike today, in 2003 there was no government agency set up to deal with cyber attacks, nor was there a dedicated national incident management function. This all changed in 2016 with the establishment of the National Cyber Security Centre (NCSC), a part of GCHQ.

Advertisement
DSEI 2025

The NCSC can reveal that in June 2003 cyber experts were called upon to investigate after a government employee detected suspicious activity on one of their workstations.

A suspected phishing email had been identified, so technical specialists sought help from the Communications-Electronics Security Group (CESG) – the information assurance arm of GCHQ at that time.

CESG’s analysis discovered that malware, designed to steal sensitive data and evade anti-virus products, had been installed, raising suspicions about the attacker’s intent and setting in motion a series of actions that was transformative to cyber incident investigations.

For the first time, GCHQ fused its signals intelligence capabilities with its cyber security function to investigate and identify the actor responsible.

The ground-breaking analysis, coupled with international engagement, led CESG to conclude the intent of the attack had been cyber espionage by a nation state, setting in train a mission that today is at the heart of NCSC operations; namely, understanding and responding to cyber threats to the UK.

Paul Chichester, Director of Operations at the National Cyber Security Centre, said: “Twenty years ago, we were just crossing the threshold of the cyber attack arena, and this incident marked the first time that GCHQ was involved in a response to an incident affecting the UK Government.

Advertisement
ODU RT

“It was also the first time that the UK and Europe started to understand the potential online risks we faced and our response transformed how we investigate and defend against such attacks.

“The NCSC and our allies have come such a long way since this incident, and it is reassuring to be at the forefront of efforts to develop tools and techniques to defend against cyber threats and keep our respective nations safe online.”

The National Cyber Security Centre, a part of GCHQ, was set up in October 2016 to help keep the UK safe online. It combined existing expertise from CESG, the Centre for Cyber Assessment, CERT-UK and the Centre for Protection of National Infrastructure (now the National Protective Security Authority).

The NCSC responds to cyber security incidents to help reduce the harm they cause to organisations and the wider UK, as well as working with other law enforcement, defence, the UK’s intelligence and security agencies and international partners.

 

Advertisement
Cranfield University
British Army EOD troop move into new base

Defence Security

British Army EOD troop move into new base

21 August 2025

A specialist British Army Explosive Ordnance Disposal (EOD) troop has moved into its new home at Gamecock Barracks, Nuneaton, Warwickshire.

Maxon showcasing drive systems at DSEI

Defence Security Space Events

Maxon showcasing drive systems at DSEI

18 August 2025

Maxon UK & Ireland is presenting its range of precision drive systems for defence applications at Defence and Security Equipment International (DSEI) UK, Excel London, from 9th-12th September.

AI set to help police thwart criminal activity

Security

AI set to help police thwart criminal activity

18 August 2025

UK Technology Secretary Peter Kyle has announced that criminals face being stopped before they can strike through the use of cutting edge mapping technology that is supported by AI - due to be rolled out by 2030 - to make our streets safer.

UK defence and national security sectors poised for growth

Defence Security

UK defence and national security sectors poised for growth

18 August 2025

Investments in the UK and European defence and national security sectors have surged in recent years, with both government funding and private capital investments increasing.

Advertisement
DSEI 2025
NPAS begins trials of uncrewed aircraft

Aerospace Security

NPAS begins trials of uncrewed aircraft

8 August 2025

The UK's National Police Air Service (NPAS) has launched its first series of trial flights of a Beyond Visual Line of Sight (BVLOS) uncrewed aircraft system (UAS), marking a significant step in the future of police air support across England and Wales.

Cranfield starts streamlining consultation

Aerospace Defence Security

Cranfield starts streamlining consultation

8 August 2025

Cranfield University is beginning a consultation on plans to restructure and resize the University to safeguard its future and set it on a new path to further opportunities in its areas of specialism.

Advertisement
DSEI 2025