British Government and Foreign Office Hit by Massive Breach of 80,000 Computers
Two numbers tell the whole story of July 5th, and they're both prices. $149.25 — what it cost Simon Willison to build a new major version of a real, widely-used data tool, most of it written by an AI. And $60,000 — what a stranger on a dark-web forum is charging for the keys to the British government. One receipt for what it costs to *build* now. One for what it costs to *fail*. Hold them side by side, because they turn out to be the same story.
Receipt one: building got almost free. Willison shipped sqlite-utils 4.0 — release candidate two of a tool thousands of data people use to wrangle SQLite from the command line — and he did the thing more maintainers should: he published the receipt. Most of it written by Claude Fable, total cost about $149.25. Sit with that. A major version of a mature, trusted piece of open-source data infrastructure, for the price of a nice dinner. Whatever you think about AI-written code, that number is the ground moving under the economics of software. The cost of *creating* has collapsed.
Receipt two: failing got expensive. Meanwhile, the headline you saw — "80,000 UK government computers breached" — is real but mislabeled. What actually happened is a breach researchers named FortiBleed: more than 80,000 Fortinet firewalls compromised across 194 countries, with cybersecurity firm SOCRadar verifying more than 86,000 working login credentials. The UK accounts include IT staff at British embassies in Thailand and Mauritius and local council workers, and the stolen set reaches into the NHS, energy companies, and pharmaceutical suppliers. A seller using the handle "SantaAd" is offering the access for as much as $60,000. That's the sticker price on the keys to a nation's critical infrastructure. And here's the part that should sting: Fortinet confirmed this wasn't a clever new zero-day — it was recycled credentials from previous incidents, brute-forced against devices that lacked multi-factor authentication.
If that failure mode sounds familiar, it should. It's the exact same one as the Azure CLI attack we covered a few days back — old passwords nobody rotated, MFA that wasn't switched on for the path the attacker actually used. Same root cause, different week, national scale. This isn't an intelligence problem. It's a hygiene problem that keeps arriving with the most sophisticated-sounding names.
So why do these two belong in the same brief? Because the force underneath them is identical. The thing that made Willison's tool cost $149 is the same thing that made the UK breach cheap: capability is now abundant and automatable. Cheap capability writes your library overnight. Cheap capability also lets an attacker spray recycled credentials against 80,000 appliances in 194 countries without breaking a sweat. Abundance doesn't pick sides — it lowers the cost of building and the cost of attacking at the same time. Which means the only variable you still control is whether you did the boring, free, unglamorous defense. Rotating a credential costs nothing. Turning on MFA costs nothing. Skipping them put a government's logins on a shelf for $60,000, with the real bill still to come.
And notice what Willison models here beyond the code: he *itemized*. He told you exactly what it cost, to the quarter. That's the discipline the FortiBleed victims didn't have — an honest accounting of what things cost and which corners got cut. You can't manage a cost you refuse to name. Willison named his build down to twenty-five cents. Most organizations couldn't tell you the cost of their security debt to the nearest million.
The kicker. The old line says a cynic knows the price of everything and the value of nothing. 2026 inverts it. The price of everything is finally legible — $149.25 to build, $60,000 to breach — and the new danger is knowing all those prices and still skipping the free thing. On every one of these breaches, the cheapest line item is the control that would have stopped it. The bill always arrives. The only question is whether you pay zero now or sixty-thousand-and-counting later.
So, the one thing to do today — two parts, both free. First, take your most exposed edge device or VPN, the thing facing the open internet, and confirm MFA is actually on and credentials have been rotated since your last known exposure. Second, in the spirit of Willison's receipt: write down, in real dollars, what your team spent on AI-assisted work this month, and what one serious breach would cost you. If the first number is legible and the second is a shrug, you already know which receipt you've been avoiding.
That's the July 5 brief. Two prices, one lesson: capability is cheap now — for you *and* for them — so the discipline is doing the free thing before the expensive thing finds you.
Sources covered
1 story · 3 sources (1 news, 0 company, 2 voices)