Daily intelligence briefing: 14 July 2026

The United States has declared a blockade of Iranian shipping in the Strait of Hormuz and a toll on other cargo after a third consecutive night of strikes, Iranian attacks on commercial vessels have left crew members dead and injured, London holds at SEVERE with Saturday’s marches the key planning point of the week, and Microsoft has set out the tradecraft behind the ShinyHunters campaign that continues to expose personal data on wealthy families.

United Kingdom and London

The national terrorism threat level remains at SEVERE, meaning an attack is highly likely. The Joint Terrorism Analysis Centre raised the level from SUBSTANTIAL on 30 April 2026, citing a rising threat from Islamist and extreme right-wing individuals and small groups based in the UK, alongside state-linked activity directed at specific communities. Nothing in the past 24 hours changes that baseline, and it should continue to frame protective planning through the summer.

Metropolitan Police reporting on Monday covered a guilty plea to the murder of the defendant’s mother in Newham and the conviction of a senior church figure for non-recent sexual offences, with an appeal for further victims to come forward. Disorder in the West End on Saturday night, following England’s World Cup quarter final win over Norway, ended with seven arrests for criminal damage and assaults on officers; England play Argentina in the semi final on Wednesday evening UK time, and central London screenings and hospitality venues should be expected to draw large and animated crowds. On the network, the Weaver line of the Overground remains closed between Hackney Downs and Chingford after a major fire in Walthamstow on Sunday evening that drew around 125 firefighters. A yellow heat health alert runs until 9pm on Wednesday, with temperatures near 30 degrees. Saturday 18 July remains the principal planning point: the National March for Palestine in central London and a separate notified march from Trafalgar Square to Hyde Park via Marble Arch will bring significant crowds and rolling road closures to Mayfair, Westminster and Park Lane, and movements that day should be settled early. Grosvenor Square reopens on Monday 20 July following its renovation.

Travel corridors

The Gulf corridor has sharpened further. United States forces struck dozens of additional Iranian targets overnight into Monday, including air defence systems, coastal radar, missile and drone capabilities and small boats, a third consecutive night of operations after around 140 targets were hit on Sunday. Iran has turned its fire on commercial shipping: a container ship was set ablaze at the weekend with a crew member still missing, and two tankers were struck on Monday, with the UAE reporting crew members killed and injured. President Trump announced that the United States will enforce a blockade of Iranian vessels in the Strait of Hormuz and charge a 20 per cent toll on other cargo transiting the waterway. Missile sirens sounded three times in Bahrain, Kuwait intercepted incoming fire and Jordan shot down four Iranian missiles. Tehran has declared the diplomatic track futile, although Pakistani and Omani channels continue to press for de-escalation, and Brent crude moved above 79 dollars. FCDO advice for the UAE, Qatar, Bahrain and Kuwait still reflects the easing of 18 June and has not been updated since; it predates the current escalation and could tighten at short notice. Our position is unchanged: non-essential travel to the Gulf should be deferred, and unavoidable itineraries must be refundable, flexible and reviewed daily rather than at departure.

In Europe, a Ukrainian court has remanded two men over the killing of the named suspect in the Monaco bombing, one of them a serving military intelligence officer, and Kyiv continues to seek a joint investigation with the Principality; principals on the Riviera should expect the visible security uplift to persist through the season. Paris reported no fresh high-value theft overnight and the Lalique museum investigation continues; profiles should stay low with valuables out of sight. Geneva and Zurich remain routine, although Swiss airports are warning of extended queues through the summer peak and additional time should be allowed. In New York, a crowd forced its way through security checkpoints outside Yankee Stadium on Monday evening, prompting a temporary lockdown of the venue and a delay of more than four hours to the concert inside; no arrests were reported. With the World Cup semi finals played this week and the final at MetLife Stadium on Sunday 19 July, intensive security operations and heavy congestion should be expected across Manhattan and the Meadowlands corridor into the weekend.

Digital and privacy exposure

Microsoft published a detailed account on Monday of the tradecraft behind the ShinyHunters campaign that has run against cloud business systems since mid 2025. Attackers telephone staff while posing as IT support and talk them into authorising malicious connected applications disguised as legitimate tools, harvest credentials from compromised third-party vendors, most recently the Klue platform in June, and exploit misconfigured guest access to extract customer records in bulk. Because the activity runs through authorised identities and approved applications, it is largely indistinguishable from legitimate usage. This is the mechanism behind many of the adviser and retail breaches tracked in recent briefings, and it underlines that a courteous, well-informed telephone call is now the standard opening move against the firms that hold family data.

The exposure pattern across the wealth management sector is unchanged: Mercer Advisors faces a second class action over the compromise of client records, the claimed breach at family office group Pathstone, said to involve roughly 641,000 records, remains unconfirmed by the firm, and Hightower has notified around 131,000 individuals. Beyond the sector, a New York laboratory group has confirmed a breach affecting 540,000 people and law firms have begun soliciting claimants over an alleged Frontier Airlines passenger data incident. Families and family offices should continue to assume that some accurate personal data is already circulating, insist on call-back verification for any change to payment instructions or contact details, brief household and office staff to treat unsolicited approaches that quote accurate personal detail as hostile until verified, and keep the family’s findable footprint under regular independent review.