Draft, not yet released. In stewardship review. Not indexed until the first approved release.

Key findings

Twelve findings carry the digital public infrastructure baseline. They are grouped by coupling and never ranked. Each resolves to its source or, where Nexus analysis is involved, to its stated method.

5 min read1 figure0 tables12 notesNR-STRATEGIC-DPI-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
  3. 1Digital systems fail together
  4. 2Key findings
    1. 2.1 Headline finding
    2. 2.2 Data and digital
    3. 2.3 CYB
    4. 2.4 Finance
    5. 2.5 Development
    6. 2.6 Systemic
  5. 3Systems and sectors at baseline
  6. 4Risks and capability
  7. 5Shared provider failure that overlaps a power or network loss
  8. 6Readings from the other desks
  9. 7The 2027 agenda
  10. 8Systems in depth
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

2.1Headline finding

ReportedEQL 4NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-CYB-006

The UK handled 204 nationally significant incidents from September 2024 to August 2025, up from 89 the year before, and 18 highly significant incidents, up from 12.

Figure 2.1UK nationally significant incidents, by reporting year
ItemBar, scaled to the largest valueValue
Sep 2023 to Aug 202489
Sep 2024 to Aug 2025204

Source: NCSC8. Both values as published. The 204 includes the 18 highly significant incidents.

Implication

Nationally significant incidents made up 48% of the 429 incidents handled. The count measures what one agency handled and classed, so it is a sign of load on that agency and of reporting practice as much as of threat8.

What would move it

The next NCSC review, ENISA reporting and any common definition of a significant incident would each move this finding.

2.2Data and digital

  1. ReportedEQL 4NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-DAT-001

    A single software update affected an estimated 8.5 million Windows devices on 18 July 2024, which Microsoft put at less than one percent of all Windows machines.3

  2. ReportedEQL 4NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-DAT-002

    A latent race condition in the DNS management system for one database service left an empty record for its regional endpoint. The event ran from 11:48 PM PDT on 19 October to 2:20 PM PDT on 20 October 2025, and services that rely on that region’s endpoints were affected.4

  3. ReportedEQL 4NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-DAT-003

    A database permissions change caused a feature file to roughly double in size and exceed a built-in limit on 18 November 2025. Core traffic resumed at about 14:30 UTC and all systems were normal at 17:06 UTC. The provider stated that no cyber attack was involved.5

  4. ReportedEQL 3NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-DAT-011

    The Estonian X-Road data-exchange layer handles 2.2 billion transactions a year across more than 3,800 e-services, and all outgoing data is digitally signed and encrypted.15

2.3CYB

  1. ReportedEQL 4NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-CYB-004

    Agencies assessed in February 2024 that a state-sponsored actor was pre-positioning on networks in communications, energy, transportation and water sectors, with access maintained for at least five years in some victim environments.6

  2. ReportedEQL 4NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-CYB-005

    A joint advisory of 27 August 2025 describes a state-sponsored campaign against telecommunications, government, transportation, lodging and military networks, active since at least 2021.7

  3. ReportedEQL 4NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-CYB-006

    The UK handled 204 nationally significant incidents from September 2024 to August 2025, up from 89 the year before, and 18 highly significant incidents, up from 12.8

  4. ReportedEQL 3NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-CYB-007

    ENISA analysed 4,875 incidents between 1 July 2024 and 30 June 2025 for the EU threat landscape.1

2.4Finance

  1. ReportedEQL 3NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-FIN-008

    The Cyber Monitoring Centre estimated the UK financial impact of the 2025 Jaguar Land Rover cyber event at about GBP 1.9 billion, with over 5,000 UK organisations affected, and placed it at Category 3 on its five-level scale.9

  2. ReportedEQL 3NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-FIN-010

    UPI processed 20.7 billion transactions worth Rs 27.28 lakh crore in October 2025, and Pix recorded about 313.3 million transactions worth R$ 179.9 billion in one day, on 5 December 2025.1314

2.5Development

  1. ReportedEQL 4NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-DEV-009

    About 6 billion people used the Internet in 2025 and 2.2 billion did not. Use was 94% in high-income countries and 23% in low-income countries, and 85% in urban areas against 58% in rural areas.10

2.6Systemic

  1. Expert inputEQL 2NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-SYS-012

    The leading compound pathway for 2027 testing is a failure at a shared cloud, identity or payment provider that overlaps a power or network loss. § scenario

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 8National Cyber Security Centre (ed.), NCSC Annual Review 2025, incident management chapter and news item (period 1 September 2024 to 31 August 2025; 429 incidents; 204 nationally significant; 18 highly significant). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
  2. 3Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices, less than one percent of all Windows machines). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
  3. 4Amazon Web Services (ed.), Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region, 19 to 20 October 2025 (post-event summary). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03.back
  4. 5Cloudflare (ed.), Cloudflare outage on November 18, 2025 (incident report). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
  5. 15e-Estonia (ed.), X-Road (programme page: 2.2 billion transactions a year; more than 3,800 e-services; outgoing data digitally signed and encrypted). e-Estonia, Tallinn. Observation year 2025. Accessed 2026-11-03.back
  6. 6CISA, NSA, FBI and partner agencies (eds.), Joint cybersecurity advisory AA24-038A on state-sponsored actor persistent access to critical infrastructure networks, 7 February 2024 (page text read to character 100,000 of 132,303). CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
  7. 7CISA and partner agencies (eds.), Joint cybersecurity advisory AA25-239A on state-sponsored actor compromise of networks worldwide, 27 August 2025 (revised 3 September 2025). CISA, Arlington. Observation year 2025. Accessed 2026-11-03.back
  8. 1ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; 4,875 incidents; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
  9. 9Infosecurity Magazine, JLR hack UK’s costliest ever, hitting economy with GBP 1.9bn loss (press report of the Cyber Monitoring Centre statement of 22 October 2025; Category 3; over 5,000 organisations); the Cyber Monitoring Centre statement itself returned an error and was not opened. Observation year 2025. Accessed 2026-11-03.back
  10. 13Entrackr, UPI hits all-time high of 20.7 bn transactions in October (press report of NPCI data: 20.7 billion transactions, Rs 27.28 lakh crore, up 25% and 16% year on year); the NPCI statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
  11. 14Agência Brasil, Pix bate recorde e supera 313 milhões de transações em um dia (press report of Banco Central do Brasil data: about 313.3 million transactions and R$ 179.9 billion on 5 December 2025; previous record 297.4 million on 28 November 2025); the central bank statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
  12. 10ITU (ed.), Facts and Figures 2025 (press release of 17 November 2025: about 6 billion online, 2.2 billion offline; 94% and 23% by income group; 85% urban and 58% rural). International Telecommunication Union, Geneva. Observation year 2025. Accessed 2026-11-03.back

Cite this chapter

Valadbaygi, S. (Ed.). (2026). Chapter 2: Key findings. In Strategic Systems Report 2026: Digital Public Infrastructure and Systemic Cyber Risk (Baseline Edition 2026, Report No. NR-STRATEGIC-DPI-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Digital Public Infrastructure and Systemic Cyber Risk.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskStrategic Systems

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices