Daily intelligence briefing: 16 July 2026

The United States has resumed its naval blockade of Iranian ports and struck dozens of further targets around the Strait of Hormuz, Iran has answered with missile attacks on American bases in Bahrain, Kuwait and Jordan, a boy aged 14 has been charged in London over an alleged extreme right-wing plot against mosques, and ransomware groups have turned directly on private equity and capital management firms.

United Kingdom and London

The national terrorism threat level remains at SEVERE, meaning an attack is highly likely. The Joint Terrorism Analysis Centre raised the level from SUBSTANTIAL on 30 April 2026, citing a rising threat from Islamist and extreme right-wing individuals and small groups based in the UK, alongside state-linked activity directed at specific communities. That assessment was given sharp illustration on Wednesday, when counter-terrorism officers charged a boy aged 14 with preparing an act of terrorism linked to extreme right-wing ideology, following an alleged plot against mosques in the Sutton area of south London. He appears before a magistrates’ court on Thursday. Police state there is no evidence of a wider threat and have contacted the affected mosques to provide support. The case underlines the youth dimension of the extreme right-wing threat that sits behind the current national threat level.

England’s World Cup campaign ended on Wednesday evening with defeat to Argentina in the semi final. Police had issued warnings to fans ahead of the fixture and scattered disorder was reported after the final whistle, but England’s exit removes the prospect of mass viewing crowds in the West End for Sunday’s final, which Argentina will contest against Spain. The yellow heat health alert for London runs until Friday evening, with the capital in a tenth consecutive day of heatwave conditions, temperatures near 30 degrees and an extreme wildfire risk across the city; hosepipe bans now cover more than eight million households. The Weaver line of the Overground is expected to reopen on Thursday following the Walthamstow fire. Saturday 18 July remains the principal planning point: the National March for Palestine assembles in central London at midday, with rolling road closures expected across Westminster, Mayfair and Park Lane, and movements that day should be settled in advance. Grosvenor Square reopens on Monday 20 July.

Travel corridors

The Gulf corridor remains the dominant concern. United States forces flew a seven hour operation into the early hours of Wednesday against dozens of targets near the Strait of Hormuz and along the Iranian coast, including Bandar Abbas, Qeshm and Bushehr, and the naval blockade of Iranian ports resumed on Tuesday evening with around 21 vessels enforcing it. President Trump has dropped the proposed 20 per cent toll on cargo transiting the strait, offering Gulf states trade and investment arrangements instead. Iran’s response has widened: the Revolutionary Guard claimed overnight strikes on the US Fifth Fleet headquarters in Bahrain, a logistics hub in Kuwait and aircraft shelters in Jordan, where three ballistic missiles were intercepted on Wednesday morning, and Tehran has threatened to halt all oil and gas exports from the region, with the Houthis signalling willingness to close both the Strait of Hormuz and the Bab al-Mandab. US commanders state that Iran has now attacked seven commercial vessels. Brent crude has moved above 86 dollars, from near 70 before the escalation. The FCDO updated its advice for the UAE on 13 July to warn that attacks could resume with little warning, and further tightening across the Gulf should be expected. Our position is unchanged: non-essential travel to the Gulf should be deferred, and unavoidable itineraries must be refundable, flexible and reviewed daily.

In Europe, the Monaco investigation continues through Ukrainian and Monegasque channels and the visible security uplift on the Riviera should be expected to persist through the season. Paris reported no fresh high-value theft overnight and the inquiry into the Lalique museum burglary continues; profiles should stay low with valuables out of sight. Geneva and Zurich remain routine, although Swiss airports continue to warn of extended queues through the summer peak and additional time should be allowed. In New York, preparation for Sunday’s final at MetLife Stadium now defines the corridor: New Jersey State Police are coordinating more than 400 local, state and federal agencies from a central command centre, officer numbers will be double those of a normal stadium event, drone surveillance will run across all sites, and there is no walk-up access, with ticket holders directed onto mass transit. Heavy congestion and intensive security operations should be expected across Manhattan and the Meadowlands corridor from Friday through the weekend.

Digital and privacy exposure

Ransomware groups have turned their attention directly to the investment sector. The Qilin group listed the private equity firm Thomas H. Lee Partners on Wednesday and INC Ransom listed the capital management firm VantagePoint Capital on the same day. Deutsche Bank has confirmed that a third-party marketing platform used by its sales partners was compromised by the Unsafe ransomware group, which has published alleged employee records; the bank states that its own systems are unaffected. The pattern is consistent with recent briefings: attackers reach the institutions that hold family wealth data through suppliers and social engineering rather than through the perimeter.

The ShinyHunters campaign against the wealth management sector continues to generate consequences. Ameriprise Financial faces litigation after a breach affecting around 48,000 customers, its second incident inside six months, with the group threatening to release more than 200 gigabytes of internal data. The claimed breach at family office group Pathstone, said to involve roughly 641,000 records, remains unconfirmed by the firm, and the Mercer Advisors and Hightower matters continue to work through the courts. Families and family offices should continue to assume that some accurate personal data is already circulating, insist on call-back verification for any change to payment instructions or contact details, brief household and office staff to treat unsolicited approaches that quote accurate personal detail as hostile until verified, and keep the family’s findable footprint under regular independent review.