Royal Mail is investigating allegations of a security breach after a threat actor leaked over 144GB of data allegedly stolen from the company’s systems. The British postal service acknowledged the situation but attributed the issue to a third-party service provider, Spectos GmbH, which recently suffered a cyberattack.
A Royal Mail spokesperson confirmed that the company is working with Spectos to determine the extent of the breach and its potential impact on data security. However, the spokesperson emphasized that Royal Mail’s operations and services remain unaffected.
Spectos GmbH, a data collection and analytics firm that supplies services to Royal Mail, disclosed that its systems were compromised on March 29, 2025. A spokesperson for the company stated that attackers gained unauthorized access to customer data, and forensic investigations are ongoing to assess the full scope of the incident.
The individual behind the data leak, operating under the alias “GHNA” on the cybercrime forum BreachForums, has claimed responsibility for the breach. GHNA released 16,549 files purportedly containing sensitive information, including personally identifiable details of Royal Mail customers—such as names, addresses, and planned delivery dates—along with confidential company documents. The leaked files reportedly also include Mailchimp mailing lists, datasets related to delivery and post office locations, a WordPress SQL database for mail agents, internal Zoom meeting recordings between Spectos and Royal Mail Group, and other sensitive materials.
While neither Royal Mail nor Spectos have disclosed how the attackers gained access, cybersecurity firm Hudson Rock suggests that the breach originated from the credentials of a Spectos employee who was compromised in a 2021 malware incident. According to Hudson Rock’s Chief Technology Officer, Alon Gal, these stolen credentials provided an entry point into Royal Mail Group’s systems. Gal noted that the stolen data remained dormant until it was recently exploited in the latest high-profile leak.
This incident is not the first time Royal Mail has faced cybersecurity challenges. In January 2023, the company suffered a ransomware attack attributed to the LockBit cybercriminal group, which forced a temporary suspension of international shipping services. Additionally, in November 2022, a system outage disrupted tracking services for over 24 hours.
