Apricorn has announced that in 2024 over 1,200 devices were reported lost or stolen across key UK government departments in its annual Freedom of Information (FoI) requests report.
The report has indicated that device security issues remain endemic across the public sector, with several departments reporting an increase in lost and stolen devices compared to the previous year, despite attempts to address the issue.
Across the 17 departments questioned, Apricorn found that more than 1,200 organisational devices were reported lost or stolen between January and December 2024.
HM Revenue and Customs (HMRC) alone accounted for 804 of these losses, including 499 mobile phones.
Whilst there has been a decrease at HMRC from Apricorn’s 2023 report with 1,015 devices lost, this still remains unfavourable, given the sensitive information the department handles.
A large number of the reported phone losses were the result of an internal audit that flagged legacy devices replaced with newer models, highlighting ongoing inventory management challenges.
Other departments such as The House of Commons showed a more concerning trend, reporting 100 devices lost or stolen during 2024, a significant increase from 65 devices the previous year.
Similarly, the Department for Education (DfE) saw device losses climb from 78 in 2023 to 107 in 2024.
The Department for Energy Security and Net Zero (DESNZ) also reported a rise, from 122 lost devices last year to 150 this year.
Meanwhile, the Department for Science, Innovation and Technology (DSIT) reported 113 missing devices.
Jon Fielding, Managing Director, EMEA, Apricorn said: “Although HMRC’s numbers suggest some improvement following internal audits, the continued high levels of device loss across government departments show that fundamental issues have not been resolved.
“Every lost or unaccounted device carries a risk for those individuals whose data could be exposed,” Fielding commented.
The findings also reveal the extent of personal data breaches, with The House of Commons disclosing 49 incidents involving personal data during 2024, up from 41 reported the previous year.
Despite these breaches, Apricorn found that The House of Commons has not had to disclose any such personal data breach to the Information Commissioner’s Office (ICO) in this period.
Worryingly, several departments that had previously been forthcoming with breach and incident reporting have opted out of disclosing its figures on lost or stolen devices to the annual Freedom of Information report.
The Ministry of Justice (MoJ) and the Department for Education (DfE), for example, both refused to disclose details on data breaches and reports made to the ICO, citing exemptions under Section 24(2) of the Freedom of Information Act (FOIA).
The exemption states that there is no duty to confirm or deny whether the requested information is held if doing so would prejudice national security.
Seven departments are still yet to respond within the deadline, including MoD Police Force, British Army, British Navy, Royal Air Force, Royal Marines, UK Health Security Agency and the Home Office/HM Passport Office.
Fielding added: “This growing lack of transparency raises further questions about the true scale of data breaches occurring within government departments and the threat to data.
“Whilst all departments confirmed their devices are encrypted, they must be supported by strong back-up protocols, inventory control and employee awareness programmes.
“A holistic approach to data protection, including frequent audits, multiple back-up copies and rigorous disaster recovery testing, is essential to minimise the risks posed by device loss and theft,” finalised Fielding.
