Prospect union data breach: what happened and what to do

Prospect, the UK trade union, was hit by a cyber attack in June 2025 and told members in October 2025. Names, contact details, dates of birth and, for some people, bank account numbers and sort codes were exposed. The ICO opened a joint investigation in December 2025.

View all 13,177 breaches

Breach date: Jun 2025
Made public: 10 Oct 2025
Data exposed: Names, Contact details, Dates of birth, Employers, Job titles, Bank account numbers
Last updated: 28 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

What happened Prospect is a UK union for scientists, engineers and technology professionals, with more than 160,000 members according to the ICO. A cyber attack in June 2025 compromised member data. Members were only told in October 2025, about four months later, and some criticised the delay. The Register reported the notification emails on 10 October 2025. On 18 December 2025 the UK Information Commissioner's Office (ICO) announced a joint investigation with the data protection authorities of Jersey, Guernsey and the Isle of Man. It will look at how much data was exposed, whether Prospect's security was adequate, whether it met its duty to report the breach, and how it responded at first. An investigation is not a finding that Prospect broke the law. The ICO notes that Prospect holds financial details and sensitive data about its members, including trade union membership, ethnic origin, sexual orientation, disability and religious belief. Union membership is itself sensitive: the list of who belongs is part of what a criminal would want. What was exposed Press reports of the notification say it covered names, contact details, dates of birth, employers and job titles. For some members it also included bank account numbers and sort codes. The union said how much was exposed varies from person to person. Reports also describe sensitive details such as ethnicity, faith and disability. Which of these were taken for which member isn't public. A name, a date of birth and a bank account number together are enough to make a phone call from a fake "bank" sound real. Details about faith or disability make a targeted message harder to dismiss. Prospect said it had no evidence the data had been misused. The company's response Prospect offered affected members 12 months of free credit and identity monitoring through Experian, with a sign-up deadline of 30 October 2025. The Metropolitan Police's cybercrime unit is also investigating. Prospect has not publicly named who was behind the attack. The number of people affected has not been stated consistently. Guernsey's data protection authority said about 3,000 people in the Bailiwick were affected.

Sources checked: ico.org.uk, theregister.com, teiss.co.uk

Last verified against the official page: 28 Oct 2026

How we research this Report an error

What to do if you were in it

1

Expect messages that quote your real details

Be wary of calls, texts and emails that use your name, employer or union membership. The NCSC warns that criminals use breach data to make scams convincing. Go to the organisation's website yourself rather than using a link in a message.
2

Report scam messages

Forward suspicious texts to 7726 and suspicious emails to report@phishing.gov.uk, as the NCSC advises.
3

Tell your bank if your account details were included

If your notification mentioned a bank account number and sort code, contact your bank so it can watch the account, and check your statements for payments you don't recognise. If you lose money, report it to Action Fraud.
4

Check your credit file

Look at your credit reports from the credit reference agencies, such as Experian or Equifax, for accounts or applications you don't recognise.
5

Check whether your email or phone is in this and other breaches

Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up. It can't remove data from a breach.

Timeline

1 Jun 2025
The breach happened
10 Oct 2025
The company made it public

Frequently asked

Was I affected by the Prospect data breach?

Prospect notified affected members by email in October 2025. If you were a member and didn't receive one, ask Prospect directly.

What was exposed in the Prospect breach?

Reports describe names, contact details, dates of birth, employers and job titles, and for some members bank account numbers and sort codes. Exposure varied by person.

Is the ICO investigating Prospect?

Yes. The ICO announced a joint investigation with the Jersey, Guernsey and Isle of Man regulators on 18 December 2025. It does not mean a conclusion has been reached.