Daily intelligence briefing: 13 July 2026

Iranian missile and drone fire reached four Gulf states over the weekend and the Strait of Hormuz remains closed to shipping, London holds at SEVERE with two large marches notified for Saturday, and a widening set of extortion claims against retailers and advisers adds to the pool of personal data now circulating on wealthy families.

United Kingdom and London

The national terrorism threat level remains at SEVERE, meaning an attack is highly likely. The Joint Terrorism Analysis Centre raised the level from SUBSTANTIAL on 30 April 2026, citing a rising threat from Islamist and extreme right-wing individuals and small groups based in the UK, alongside state-linked activity directed at specific communities. Nothing over the weekend changes that baseline, and it should continue to frame protective planning through the summer.

The Metropolitan Police newsroom was quiet over the weekend; the latest reporting, from Friday, covered charges against three men over the murder of Matheus Dos Santos Mori in Thornton Heath, guilty pleas at Kingston Crown Court over a Richmond jewellery shop robbery, and the recovery of more than £500,000 of suspected stolen goods from an organised handling network. The BST Hyde Park concert series concluded last night, so Park Lane and the surrounding routes return to normal running this week. One live disruption remains: the A40 Westway is closed westbound between the Marylebone Flyover and the Westway Roundabout following a bus fire, with reopening still subject to assessment. Looking ahead, Saturday 18 July brings the National March for Palestine in central London and a separate notified march from Trafalgar Square to Hyde Park via Marble Arch; movements through Mayfair, Westminster and Park Lane that day should be planned around significant crowds and rolling road closures.

Travel corridors

The Gulf corridor remains acute. In the early hours of Sunday, Iranian missiles and drones were fired at Qatar, Kuwait, Bahrain and the United Arab Emirates, with further drones directed at Oman’s Musandam governorate; Qatar reported three people injured by falling debris, including a child, and the UAE confirmed that its air defences engaged incoming threats. United States Central Command struck around 140 Iranian military targets in response, and Iran continues to declare the Strait of Hormuz closed to shipping until further notice. The ceasefire that collapsed on 9 July has not been restored, although Washington and Tehran have agreed to keep talking and Omani channels remain open. Dubai International continues to operate at reduced capacity; Emirates has resumed a limited schedule, while some sixteen international carriers, including British Airways and KLM, have suspended Dubai routes. FCDO advice for the UAE was softened in June and, as of this morning, has not returned to advising against travel, but it predates the weekend attacks and could change at short notice. Our position is unchanged: non-essential travel to the Gulf should be deferred, and unavoidable itineraries must be refundable, flexible and backed by a tested contingency for extended disruption.

In Europe, Ukraine’s Prosecutor General has called for a joint investigation with Monaco into the 29 June bombing that seriously injured businessman Vadym Yermolaiev, after the named suspect was found shot dead near Kyiv and two men were detained over her killing, one of them a serving military intelligence officer. Principals on the Riviera should continue to expect a visible security uplift through the season. Paris remains in a sustained wave of high-value acquisitive crime: the theft of twenty-seven pieces from the Lalique museum, valued at more than four million dollars, follows the Louvre case, and profiles should stay low with valuables out of sight. Geneva and Zurich report no acute incidents beyond routine seasonal pickpocketing advisories. In New York, the early July heat emergency has passed and movements this week can be planned around ordinary summer conditions.

Digital and privacy exposure

Litigation against breached wealth managers continues to build. Mercer Advisors faces a second class action over the ShinyHunters compromise of client records held in its systems, and the claimed breach at family office group Pathstone, said to involve roughly 641,000 records, remains unconfirmed by the firm. Alongside the earlier incident at Beacon Pointe, the pattern is unchanged: organised criminal groups are working through the wealth management sector deliberately, because adviser systems concentrate exactly the personal, financial and legal detail that makes wealthy families targetable.

The wider extortion campaign is also broadening. ShinyHunters has issued a second demand against food distributor Sysco, claiming sixty-one million Salesforce records, now claims around 1.5 billion Salesforce linked records in total from the Drift compromises, and has listed further alleged victims including Zara, 7-Eleven and Pitney Bowes; a separate actor claims source code and access credentials taken from a major consultancy, and an insurance breach has exposed identity data on nearly seven million customers. Families and family offices should assume that some accurate personal data is already circulating, insist on call-back verification for any change to payment instructions or contact details, brief household and office staff to treat unsolicited approaches that quote accurate personal detail as hostile until verified, and keep the family’s findable footprint under regular independent review.