A threat actor claims to have leaked a large internal data dump from Tipping Point UK, a UK workers’ cooperative that provides organizing support and shared technology to climate and social justice campaigns. The post also targets Pull The Plug UK, its flagship campaign against unchecked AI expansion and new data centres. The claim has not been verified.
What the actor says is in the dump
The post, dated October 26, 2026, allegedly offers a free download of 671 files with no password or expiry. According to the claim, the archive includes:
- 48 database tables across 10 databases, covering campaign tasks, an actions tracker, KPIs, contractor records, donors, personnel and interaction logs
- An internal wiki of 107 documents (about 531KB), including strategy papers, a members’ handbook and planning packs for a December 2026 march
- A table of press contacts and lists of activists and speakers, reportedly with email addresses and phone numbers
- Funding model details, a full user list and an activity audit log
The actor says the release follows through on an earlier ultimatum that the group allegedly failed to honor. BreachNews could not find any public trace of that earlier contact.
A political motive, but thin credibility
The post frames the leak as retaliation tied to demands about Israel, which the actor says the group refused. Several campaigns Tipping Point UK supports have publicly campaigned against Israel-linked companies, so the motive is plausible. That does not show the breach happened.
The account appears new, with a single post and no reputation, and no known group name is attached. Many of the claimed details, such as the size of Pull The Plug’s membership, its anonymous tech-industry funder and the December march, match public reporting, so they do not prove access to internal systems. At least one organizational detail in the post also does not line up with how Tipping Point describes its own legal structure on its website.
Why the data matters if it is real
Records of donors, members, activists, speakers and journalists can reveal political opinions, which count as special category data under UK GDPR. If the material is genuine, the people listed could face doxxing, harassment, phishing and impersonation, and journalists named in a contacts table could be targeted. The leak could also expose the identity of a funder who asked not to be named.
UK organizations that suffer a reportable personal data breach must notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it, according to the Information Commissioner’s Office. It is not known whether any report has been filed.
Tipping Point UK and Pull The Plug UK had not issued any public statement at time of publication, and a check of their official sites, tippingpointuk.org and pulltheplug.uk, showed no security notice. Both sites were online.
Politically motivated leaks aimed at organizations on the other side of a conflict have become a familiar pattern, as seen in claims involving IranWire and Yad Vashem. BreachNews will update this story if either organization responds or the data is independently verified.
