Daily intelligence briefing: 19 July 2026

Two American service members have been killed in Jordan and a third is reported missing after Iranian strikes on the Al-Azraq base, and the United States has answered with an eighth consecutive night of attacks on Iran, keeping the Gulf firmly closed to discretionary travel. In London, attention turns to this evening’s World Cup final between Argentina and Spain, screened across the capital against a backdrop of extensive Sunday rail closures, while on the digital side Microsoft’s mapping of a year of ShinyHunters activity sets out, in unusual detail, exactly how attackers reach the suppliers and advisers who surround private wealth.

United Kingdom and London

The national terrorism threat level remains at SEVERE, meaning an attack is highly likely. In the Counter Terrorism Policing investigation into the suspected extreme right-wing threat against the Islamic gathering at Shrubland Hall in Suffolk, seven men were released from custody without charge on Saturday evening; the investigation and searches at linked addresses continue, and police continue to state there is no evidence of a wider threat to the public. Saturday’s National March for Palestine assembled at Russell Square and proceeded to Whitehall within the conditions imposed under the Public Order Act, with no significant disorder reported in open sources, and some 4,000 officers were deployed across the day. Separately, the Metropolitan Police confirmed that a 39 year old man has been charged with an offence under the National Security Act following a counter terrorism investigation, a reminder that state threat casework continues alongside the terrorism picture.

Today’s principal consideration is the World Cup final between Argentina and Spain, which kicks off at 8pm UK time and will be screened across hospitality venues throughout the capital, with the London Craft Beer Festival at Southwark Park, the Somerset House Summer Series and the LatinoLife festival in Ealing adding to crowd concentrations through the afternoon. Dense and celebratory crowds should be expected around Argentine and Spanish gathering points in the West End, Soho and the South Bank from mid evening, with movement through hospitality districts slow after 10pm. Rail access is the complicating factor: the Piccadilly line is closed between King’s Cross St Pancras and Cockfosters all day, Finsbury Park station is closed, the DLR is suspended between Bank and Poplar, and the Elizabeth line is not serving Heathrow before 7am, so early airport departures should move by road and journeys across north and east London should be planned around the gaps.

Travel corridors

Iranian strikes on the Al-Azraq base in Jordan have killed two American service members, with a third reported missing, the first confirmed American fatalities of this phase, and Jordan’s armed forces separately intercepted ten Iranian missiles. In Kuwait, the Kuwait Petroleum Corporation reported severe material losses and injuries at a vital oil sector facility after repeated strikes, and Bahrain’s military intercepted further attacks. The United States responded with an eighth consecutive night of strikes on Iran, ordered from Saturday evening Washington time, and Tehran has announced it is suspending its commitments under the memorandum of understanding, hardening both positions. The Foreign Office position is unchanged: against all but essential travel to Bahrain, Kuwait, Qatar and the United Arab Emirates, with British nationals advised to shelter during attacks and register with the FCDO. Aviation disruption continues to deepen, with British Airways suspensions to Dubai, Bahrain and Amman running to late October, KLM, Lufthansa, Air France and Singapore Airlines holding their own suspensions, and rolling cancellations and delays across Dubai, Abu Dhabi, Sharjah and Doha. Our position stands: all Gulf travel, including Dubai, should be deferred, and principals still in the region should depart early on refundable routings rather than wait for conditions to force the decision.

In New York, the final kicks off at 3pm local time at MetLife Stadium before a capacity crowd of 82,500, and the American president is expected to attend and present the trophy, which brings airspace restrictions, motorcade movements and exceptional screening to the Meadowlands corridor. The standing measures apply: 42nd Street is closed to traffic from First to 12th Avenue between 8am and 11pm, a truck ban covers Midtown from 30th to 60th Street, NJ Transit service from Penn Station is restricted to match ticket holders from 11am, and a 50,000 person watch party occupies the Great Lawn in Central Park with the Rockefeller Center fan village operating walk-in. Midtown Manhattan should be avoided by vehicle today, transfers to JFK and Newark should carry generous buffers, and long journey times should be assumed across the Meadowlands corridor into the early hours. In Europe the picture is steadier: the Monaco suspect remains at large under an international arrest warrant and Interpol red notice, so the visible uplift on the Riviera persists; France reported no fresh high-value theft overnight, although the run that includes the Lalique museum burglary continues to justify a low profile with valuables out of sight; Geneva and Zurich remain routine, with Swiss airports still warning of extended queues through the summer peak.

Digital and privacy exposure

Microsoft has published a mapping of a year of ShinyHunters activity against Salesforce environments, and it deserves attention because it describes the three routes attackers actually take into the firms that serve wealth. The first is voice phishing, with staff talked into approving rogue connected applications posing as legitimate Salesforce tools; the second is the theft of OAuth tokens from suppliers with existing integrations, the route through Salesloft Drift that touched some 700 organisations and through Gainsight that reached more than 200; the third is over-permissive guest access to customer portals. None of these exploits a flaw in the platform itself; each abuses trust that has already been granted. The leak site postings continue in parallel, with Fluke and Ingram Content Group added and data from the latter, said to include social security numbers, now published, while the unverified Gehenna claim against Coca-Cola Europacific Partners and the production halt at fairlife show the same groups disrupting operations as readily as they steal data. Families should ask which connected applications and third parties hold live access to the systems their advisers run, because that is precisely the inventory attackers are working from.

Two fresh campaigns bear directly on households and family offices. The ACR Stealer operation is drawing saved browser passwords, live session tokens and synced cloud documents out of compromised devices using so-called ClickFix lures that talk users into running a command themselves, and the North Korean OtterCookie campaign is folding a credential and cryptocurrency wallet stealer into fake recruitment approaches aimed at professionals, an approach that reaches next generation family members and household staff as easily as developers. A SharePoint flaw, CVE-2026-58644, has meanwhile been added to the American known exploited vulnerabilities list and should be patched promptly by any professional firm or family office running the platform. The controls are unchanged: assume accurate personal data is circulating, insist on call-back verification for any change to payment instructions or contact details, review third party and connected application access on a regular cycle, and treat unsolicited approaches that quote accurate personal detail, including offers of employment, as hostile until verified.