Investigation into Three following voice service outage on 25 June 2025

Ofcom has today opened an own-initiative investigation into Three’s compliance with sections 105A and 105C of the Communications Act 2003 and the Electronic Communications (Security Measures) Regulations 2022 (the Regulations). The investigation follows Three’s notification of an incident which resulted in UK-wide disruption to voice services, including customers’ ability to contact emergency services, on 25 June 2025.

Section 105A requires providers of public electronic communications networks and services (providers) to take such measures as are appropriate and proportionate to identify and reduce the risks of, and prepare for the occurrence of, security compromises, including, anything that compromises the availability, performance or functionality of the network or service.

Section 105C requires providers to take such measures as are appropriate and proportionate to prevent adverse effects arising from a security compromise that has occurred. Where a security compromise has an adverse effect on the network or service, the provider must take such measures as are appropriate and proportionate to remedy or mitigate that effect.

The Electronic Communications (Security Measures) Regulations were made under sections 105B and 105D and require providers to take specified measures or measures of a specified description, including in response to security compromises. A measure or description of measure may be specified only if the Secretary of State considers that taking that measure or a measure of that description would be appropriate and proportionate.  

Ofcom’s investigation will seek to establish the facts surrounding the incidents and examine whether there are reasonable grounds to believe that Three has failed to comply with its regulatory obligations.