Daily intelligence briefing: 17 July 2026

The Foreign Office now advises against all but essential travel to Bahrain, Kuwait, Qatar and the United Arab Emirates as American strikes on Iran run into a sixth consecutive day, a boy aged 14 has been remanded in youth detention after denying the alleged plot against south London mosques, Saturday’s national march will close roads across central London, and a confirmed incident at Accenture has placed supplier held credentials at the centre of the digital threat picture.

United Kingdom and London

The national terrorism threat level remains at SEVERE, meaning an attack is highly likely. The boy aged 14 charged over the alleged extreme right-wing plot against two mosques in Sutton appeared at Westminster Magistrates’ Court on Thursday and pleaded not guilty to preparing an act of terrorism and to a separate charge of racially aggravated criminal damage. Prosecutors allege that he planned to stab worshippers, carried out online reconnaissance of the targeted sites and held a document professing inspiration from Hitler and other violent extremists. He was remanded in youth detention and is next due before the court on 21 August. The case reinforces the youth dimension of the extreme right-wing threat that sits behind the current national threat level, and police continue to state there is no evidence of a wider plot.

Saturday 18 July is the principal planning point for London. The National March for Palestine assembles at Russell Square from midday and moves through Holborn to a rally at Whitehall, with rolling road closures expected across Bloomsbury, Holborn, the Strand and Westminster between roughly 11am and late afternoon; movements across the West End on Saturday should be settled in advance. Sunday’s World Cup final between Argentina and Spain will still draw heavy crowds to pubs and hospitality venues despite England’s exit, and journey times around screening locations should be padded accordingly. The yellow heat health alert for London is due to expire on Friday evening as the long heatwave finally eases, although hosepipe bans remain in force and wildfire risk stays elevated until conditions break. The Weaver line of the Overground reopened on Thursday with minor delays following the Walthamstow fire, and Grosvenor Square remains on schedule to reopen on Monday 20 July.

Travel corridors

The Foreign Office has hardened its position on the Gulf and now advises against all but essential travel to Bahrain, Kuwait, Qatar and the United Arab Emirates, with British nationals in those countries told to shelter in place during attacks and to register their presence with the FCDO. The change follows a sixth consecutive night of American strikes on Iran, with explosions reported at Bandar Abbas, Ahvaz and Iranshahr, the disabling of an Iranian tanker attempting to run the naval blockade, and air defence sirens sounding again in Bahrain and Kuwait. US commanders state that Iran has attacked seven commercial vessels since the escalation began, traffic through the Strait of Hormuz has thinned markedly and oil prices remain sharply elevated. Iran’s military has warned that regional infrastructure will come under sustained attack if the United States strikes civilian sites. Our position strengthens accordingly: all Gulf travel, including Dubai, should now be deferred; principals already in the region should hold refundable departure options, keep itineraries under continuous review and ensure their presence is registered.

In Europe, the Monaco investigation has produced an international arrest warrant for the main suspect and the visible security uplift on the Riviera should be expected to persist through the season. Paris reported no fresh high-value theft overnight, although the run of museum and jewellery burglaries in France continues to justify a low profile with valuables out of sight. Geneva and Zurich remain routine, with Swiss airports still warning of extended queues through the summer peak. In New York, the final weekend measures are now published: 42nd Street closes to traffic from First to 12th Avenue on Sunday between 8am and 11pm, a truck ban covers Midtown from 30th to 60th Street, NJ Transit services from Penn Station will be restricted to match ticket holders from 11am, the Rockefeller Center fan village runs from Friday through Sunday and a 50,000 person watch party occupies the Great Lawn in Central Park. Midtown Manhattan should be avoided by vehicle on Sunday, and long transfer times should be assumed across the Meadowlands corridor all weekend.

Digital and privacy exposure

Accenture has confirmed a security incident after an actor using the alias 888 advertised some 35 gigabytes of material said to include source code, RSA and SSH keys, Azure access tokens and configuration files, apparently taken from a developer environment. The firm states that its operations and service delivery were unaffected and that the source of the incident has been remediated, but the exposure sits with the clients whose environments those credentials could reach. The lesson for family offices is the same one this briefing has carried for weeks: the professional services firms, marketing platforms and technology suppliers that surround wealth are the route attackers now take to it.

The ShinyHunters campaign against Salesforce environments continues to widen, with the group claiming more than 61 million records from the food distributor Sysco only weeks after the Qilin ransomware group hit the same firm, a pattern of repeat victimisation that is becoming standard. Earlier claims in the same campaign include Madison Square Garden, Ralph Lauren and Kodak, which places customer, membership and lifestyle records of direct relevance to prominent families in circulation. The wealth sector matters reported in recent briefings, including the Ameriprise litigation and the unconfirmed claim against the family office group Pathstone, continue to work through. The controls are unchanged: assume that some accurate personal data is already circulating, insist on call-back verification for any change to payment instructions or contact details, review which third parties hold live access to family CRM and cloud systems, and brief household and office staff to treat unsolicited approaches that quote accurate personal detail as hostile until verified.