UK SECURITY
INTELLIGENCE BRIEF
WEEK 39 | 21-27 SEPTEMBER 2026
National Security • Crime • London • Retail • Cyber • Regulation
OFFICIAL UK THREAT
Attack highly likely
WEEKLY FOCUS
CORE ACTION
Preserve • Report
WEEK AT A GLANCE
| SECURITY AREA | POSITION | DIRECTION | THIS WEEK |
|---|---|---|---|
| UK terrorism | SEVERE - official | No change | Two significant counter-terrorism investigations |
| Counter-terrorism activity | HIGH FOCUS | Up | Manchester + RAF Fairford |
| Serious / organised crime | HIGH FOCUS | Stable | London firearms and OCG cases |
| Retail / commercial crime | HIGH FOCUS | Stable | 507,086 annual shoplifting offences |
| Cyber security | HIGH FOCUS | Stable | 43% of UK businesses identified a breach/attack |
| State / hybrid threats | HIGH FOCUS | Up | Government CNI briefings on Russian threats |
| London environment | ELEVATED | Stable | Serious violence, acquisitive crime, spiking |
WHAT CHANGED?
INCREASED FOCUS
BROADLY STABLE
WATCH NEXT
OBSERVE • RECORD • PRESERVE • REPORT
KEY INCIDENTS OF THE WEEK
COUNTER-TERRORISM
Counter Terrorism Policing said two men in their 30s were arrested under Section 41 of the Terrorism Act 2000 in connection with a suspected terrorist plot targeting the Jewish community in the Manchester area. Police described it as a long-running proactive investigation and said they did not believe there was an ongoing threat to the public from that particular matter.
Source: Metropolitan Police / Counter Terrorism Policing | https://news.met.police.uk/news/update-counter-terrorism-policing-arrests-in-manchester-513132
STATE / HYBRID THREAT
The Government announced closed-door security briefings for representatives from defence and Critical National Infrastructure sectors concerning threats posed by Russia, including hybrid activity.
Source: UK Government | https://www.gov.uk/government/news/ceos-from-sensitive-sectors-to-receive-briefings-on-russia-threats
COUNTER-TERRORISM
Police responded after a report of three suspicious vehicles apparently travelling towards RAF Fairford. Five men were arrested initially on suspicion of offences under the Explosives Act and subsequently on suspicion of preparation of a terrorist act under Section 5 of the Terrorism Act 2000. Counter Terrorism Policing took responsibility for the investigation.
Source: Metropolitan Police / Counter Terrorism Policing | https://news.met.police.uk/news/counter-terrorism-policing-update-in-relation-to-incident-in-gloucestershire-513316
UK CRIME SNAPSHOT
SHOPLIFTING
Down 4%
ROBBERIES
Up 10%
PERSONAL ROBBERY
Down 9%
BUSINESS ROBBERY
Up 91% recorded
KNIFE / SHARP
Down 8%
FIREARMS
Down 8%
HEADLINE CSEW
Latest annual
VIOLENCE
Estimated incidents
Source: ONS, Crime in England and Wales: year ending March 2026 | https://www.ons.gov.uk/peoplepopulationandcommunity/crimeandjustice/bulletins/crimeinenglandandwales/latest
NATIONAL SECURITY
A TERRORIST ATTACK IS HIGHLY LIKELY
Source: UK Government - national terrorism threat level | https://www.gov.uk/terrorism-national-emergency
RETAIL & COMMERCIAL CRIME
SHOPLIFTING OFFENCES
Latest annual
BUSINESS ROBBERIES
Latest annual
SHOPLIFTING
Annual decrease
BUSINESS ROBBERY
Recorded increase
Retail and commercial security should focus on repeat patterns, coordinated groups, distraction tactics, vehicles, staff intimidation and preservation of CCTV or other evidential material.
LONDON WATCH
SERIOUS VIOLENCE
ORGANISED CRIME
SPIKING
Source: Metropolitan Police weekly releases | https://news.met.police.uk/
CYBER SECURITY
UK BUSINESSES
Identified breach/attack
PHISHING
Businesses affected
IMPERSONATION
Businesses affected
MALWARE
Businesses affected
Source: UK Government, Cyber Security Breaches Survey 2025/26 | https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
STATE THREATS & NATIONAL RESILIENCE
- Espionage
- Cyber activity
- Sabotage
- Information operations
- Physical surveillance
- Critical National Infrastructure security
REGULATORY WATCH
Home Office guidance on regulated poisons and explosives precursors was updated on 25 September 2026. Businesses dealing with regulated or reportable substances have reporting obligations for specified suspicious transactions, thefts or disappearances.
Source: Home Office guidance | https://www.gov.uk/government/publications/supplying-explosives-precursors/supplying-explosives-precursors-and-poison
SECURITY OFFICER BRIEF
| INDICATOR | ACTION |
|---|---|
| Repeated surveillance | Record person, location, time and behaviour |
| Suspicious vehicles | Capture VRM, description and direction |
|---|---|
| Unusual photography | Record subject and behaviour |
| Access probing | Escalate repeated or unexplained attempts |
| Suspicious / unattended items | Follow site emergency procedure |
| Coordinated theft | Preserve CCTV and identify linked incidents |
| Phishing / impersonation | Use cyber/security escalation |
| Suspicious chemical activity | Follow legal and organisational reporting process |
OPERATIONAL ASSESSMENT
COUNTER-TERRORISM AWARENESS
Official threat level remains SEVERE. Two significant counter-terrorism investigations featured during the reporting period.
SUSPICIOUS VEHICLES & RECONNAISSANCE
The RAF Fairford incident reinforces the value of accurate, timely reporting around sensitive locations.
INFORMATION & CYBER SECURITY
Phishing remains the dominant identified cyber attack type. Security, IT and management should share relevant intelligence.
RETAIL / COMMERCIAL SECURITY
Focus on repeat behaviour and linked intelligence, particularly where theft is accompanied by threats or violence.
LONDON SERIOUS CRIME
Firearms investigations, organised criminal groups and predatory offending remain relevant to the London security environment.
SEE THE DETAIL. RECORD THE FACTS. CONNECT THE PATTERN.
DATA & METHODOLOGY
- Weekly incidents are based on verified official announcements and may continue to develop after publication.
- National crime figures use the latest ONS Crime in England and Wales dataset available for year ending March 2026.
- Cyber statistics use the UK Government Cyber Security Breaches Survey 2025/26.
- Police-recorded crime can be affected by reporting levels, police activity and recording practices.
- An arrest, charge or investigation does not establish guilt; criminal responsibility is determined through the judicial process.
- Annual statistics provide context and should not be read as incidents occurring solely during 21-27 September 2026.
PRIMARY SOURCES
1. UK terrorism threat level - gov.uk
2. ONS - Crime in England and Wales: year ending March 2026 - ons.gov.uk
3. Cyber Security Breaches Survey 2025/26 - gov.uk
4. CT Policing - Manchester arrests - news.met.police.uk
5. CT Policing - RAF Fairford / Gloucestershire - news.met.police.uk
6. UK Government - Russia / CNI briefings - gov.uk
7. Home Office - explosives precursors and poisons - gov.uk
8. Metropolitan Police newsroom - news.met.police.uk