INCIDENT REPORT · CP-2023-001
Royal Mail international export ransomware attack
L3 · ELEVATEDCONFIRMED
A ransomware attack on Royal Mail's systems at its Heathrow Worldwide Distribution Centre in January 2023 halted international export services. LockBit claimed responsibility.
- Incident ID
- CP-2023-001
- Incident date
- 10 JAN 2023
- Detection date
- 10 JAN 2023
- Affected countries
- United Kingdom
- Plotted location
- London, United Kingdom (Affected facility (Heathrow Worldwide Distribution Centre))
- Threat classification
- Level 3 — ELEVATED
- Classification rationale
- Weeks-long disruption of the national postal operator's international export service.
- Attack type
- Ransomware
- Nature
- Malicious activity
- Attack vector
- Not publicly documented
- Sectors
- Logistics, Transportation
- Critical infrastructure
- Yes
- Organizations affected
- Royal Mail (International Distributions Services)
- Operational consequences
- International exports were suspended for weeks and customers were asked to hold overseas items. Services were restored in stages through February 2023.
- Estimated financial impact
- Parent company International Distributions Services reported £10 million in remediation and resilience costs, a partial figure; ITPro converted it to about $12.4m.
- Attribution (as stated)
- No official attribution recorded
SOURCE REFERENCES
- [1] Royal Mail has spent £10 million in remediation costs after LockBit cyber attackITPro · itpro.com
- [2] Royal Mail cyber incident halts international exportsThe Register · theregister.com · 11 JAN 2023
RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.