And that’s the big security risk. By bringing it all into one place you are making it a target for hackers and bad actors. And the government is proposing to use One LogIn which has multiple significant security concerned. As recently as March this year, IT security consultancy Cyberis revealed a serious vulnerability allowing privileged access to the system to be compromised without detection by security monitoring tools, raising concerns about potential exposure of personal data and software code. This is despite having earlier warnings from the National Cyber Security Centre (Sept 2023). which identified "severe shortcomings" in cyber security, including a "risk of impersonation leading to mass fraud" and a "bulk personal data breach". The NCSC concluded at that time that the system's current design and operating procedures left significant risks. And there are other failed audits. So despite warnings over the years it is still poses significant security risks some of which appear to be regarding its inherent design.
In July 2022, a whistleblower raised concerns, reporting that the digital identity team lacked sufficient security and assurance personnel, had no formal risk or threat assessment, and no information security management system was in place.
A cyber security expert has today described the system as a "honeypot" for cybercriminals due to its scale and comprehensiveness, making it far more attractive than past breaches like the NHS hack. And that a ‘nightmare scenario" involves a single breach exposing the entire population's data, which could be used for identity fraud, scams, and targeted phishing, on a nationwide scale.
This is not a safe and innocuous solution.