Defence Personnel Data Breach

I would like to update the House on a data incident involving activity by a malign actor. In recent days, the Ministry of Defence has identified indications that a malign actor gained access to part of the armed forces payment network. That is an external system, completely separate from the Ministry of Defence’s core network, and it is not connected to the main military human resources system. The House will wish to note that it is operated by a contractor, and there is evidence of potential failings by it, which may have made it easier for the malign actor to gain entry. A specialist security review of the contractor and its operations is under way, and appropriate steps will be taken.

The contractor-operated system in question holds personal data of regular and reserve personnel and some recently retired veterans. That includes names and bank details, and—in a smaller number of cases—addresses. In response to the incident, we have undertaken significant and immediate action, enacting a multi-point response plan to support and protect our people. I would like to provide the House with details of this eight-point plan.

First, we immediately took the system offline. That has secured it against similar future threats. Secondly, we have launched a full investigation, drawing on Cabinet Office support and specialist external expertise to examine the potential failings of the contractor and to minimise the risk of similar incidents.

Thirdly, while our initial investigations have found no evidence that any data has been removed, as a precaution we have today alerted those service personnel affected through the chain of command. In addition, we are also sending out letters to a small number of veterans who have retired and who may have been affected as an additional precaution. The House will wish to note that the vast majority of the UK veterans community is, however, unaffected.

Fourthly, specialist advice and guidance on data security has been shared and will be available on gov.uk later today. Fifthly, we have additionally set up a helpline to support individuals. The number for the helpline is 01249 596665, and it will be available from today.

Sixthly, we are providing a commercial personal data protection service for all service personnel. That facility will constantly monitor each individual’s personal data and notify them if there are any irregularities. Even though we do not believe that their information has been stolen, we intend to do that in order to bring further peace of mind.

Seventhly, welfare and financial advice is available where needed through each individual’s chains of command.

Eighthly, on becoming aware of the incident, the MOD stopped the processing of all payments and isolated the system. I want to provide further detail on that step. We are making changes to the system to ensure that it is secure before recommencing payments through it. I confirm, though, that, in the meantime, all April salaries have been paid. Some service personnel will have experienced a slight delay in receiving some expense payments; however, we expect that to be fully resolved today, with the money in their accounts by Friday.

Furthermore, I confirm that we are ensuring that all high-value payments remain unaffected. For example, all outstanding Forces Help to Buy and terminal benefits payments have been facilitated by alternative secure transfer. As mentioned, salary payments and pensions for veterans have not been affected, and we do not expect them to be.

For reasons of national security, we cannot release further details of the suspected cyber-activity behind the incident. However, I can confirm to the House that we do have indications that this was the suspected work of a malign actor, and we cannot rule out state involvement. The incident is further proof that the UK is facing rising and evolving threats. As I set out in my speech at Lancaster House in January, the world is, I am afraid, becoming somewhat more dangerous. Last month, the Government therefore announced an increase in defence spending to meet those new threats, reaching 2.5% of GDP by the end of the decade.

Following this incident, I can announce today that although this incident is entirely unrelated to our own MOD networks, we are also reviewing all personnel data networks to ensure that our people’s data is secure. This was the work of a malign actor who compromised a contractor-run network entirely separate from the MOD core system. However, as I have said, we cannot at this stage rule out state involvement from elsewhere. This eight-point plan outlines the immediate and significant action we are taking to protect our most precious resource: our people. Even though this occurred on a contractor’s system, with a malign actor involved—and we cannot rule out foreign state involvement—I want to apologise to the men and women affected. It should not have happened, and this eight-point plan seeks to ensure that it is put right and cannot happen again. I commend the statement to the House.

There is deep concern in the House about this grave security breach. The House will accept and note the Defence Secretary’s apology to armed forces personnel. We welcome the statement and the multipoint plan, and I thank him for early sight of it.

There will indeed be serious concern in the MOD that news of this big data breach was splashed across the media before the Defence Secretary could set out the facts to Parliament. My overriding concern is for the safety of serving personnel and veterans affected, worried about the risk to themselves and their families and hearing first about the data being hacked from the media and not from the MOD. Our military put their own security at risk when they serve on the frontline, and the very last thing they should have to worry about is their data security back home. Any such hostile action against our forces is utterly unacceptable, and their protection must be the first-order priority for the Defence Secretary, whether on operations abroad or for their data at home.

Despite the Defence Secretary’s statement, he still has many serious questions to answer. On the breach itself, who held the data that was hacked? When was it discovered? When were Ministers told? How was it leaked to the press? On the contractor, Defence Business Services says that Shared Services Connected Ltd has the MOD contract for core payroll and other business services. How many contracts does SSCL or its parent company, Sopra Steria, have with the MOD? What action has been taken by other Government Departments with similar SSCL contracts? On forces personnel, how many serving personnel and veterans have been hit by the hack? Has every serving full-timer and reservist been affected? What support is being offered?

On last night’s media reports, has a leak inquiry been launched? The MOD’s data security record is getting worse while threats against the UK continue to rise. There has been a threefold increase in MOD data breaches in the last five years, with 35 separate MOD breaches reported to the Information Commissioner’s Office and a £350,000 fine last December. Sub-contractors are well known to be the soft underbelly of security, and this latest hack raises serious questions about how the MOD manages its outsourced services.

I thank the right hon. Gentleman for his words about the united way in which this House tackles such issues, and there is much of what he says that I can agree with. He asked a number of questions and I will try to rattle off some responses to him.

The chosen date to announce this breach was today, to ensure that we would be able to secure the systems, back up and make sure everyone had their payments made, even if it was not through those systems. The media release last night was coincidental and unwelcome, as far as we were concerned, but unfortunately a lot of people are involved in this. He asked how many personnel had been affected, and the number is 272,000. I stress that that means it is up to that number; the number is still being refined and will probably end up lower, but none the less it is a large number of people and they may have noticed that bank payments were not made, so some of the media will have picked up on that.

The right hon. Gentleman is right to say that the welfare of our personnel is our absolute first priority. I hope that he will agree that the eight-point plan focuses heavily on that and consists of ensuring that they are getting every bit of help and support required. Although we do not think the data is necessarily stolen, we are making the assumption that it has been in order to ensure that personnel get the support required, including through their own data monitoring services, which we are providing to each and every one of them, whether or not they are affected in this particular case.

The right hon. Gentleman has named the contractor involved, and I can confirm that that is the correct name, SSCL. As I mentioned in my statement, we have not only ordered a full review of its work within the MOD, but gone further and requested from the Cabinet Office a full review of its work across Government, and that is under way. I also briefly mentioned specialists being brought in to carry out a forensic investigation of the way this breach has operated.

SSCL was a joint venture with the Cabinet Office—I think there was a legacy minority stake held until last year. As is public, it also provides services to, from memory, the Metropolitan police, the Home Office and the Ministry of Justice. I welcome the Secretary of State’s remark that the investigation will be across Government, because absolutely all areas of Government that are exposed need to be doing the necessary. What specialist support is he receiving from elsewhere in Government, and when might the malign actor be named?

As my right hon. Friend will know, the process of getting towards naming—if, indeed, a state-sponsored actor is involved—is a specific process set out by the Butler reforms, and it does take some time to reach such conclusions.

My right hon. Friend asked specifically about the ongoing work with the particular contractor. The Cabinet Office is calling in specialist analysts who will carry out that work over the coming weeks. There are two separate tracks in respect of the contractor in the MOD but also, separately, in the different places across Government that my right hon. Friend rightly identified. I stress to the House—because I suspect that this will be brought up a number of times—that we expect very high standards from our contractors that work with the lives and livelihoods of our service personnel, so we will take all appropriate actions.

I thank the Secretary of State for advance notice of the statement. There was not really much to disagree with in the questions from the shadow Defence Secretary, but I will perhaps ask for a little bit extra. On what the Secretary of State said in relation to there being a malign actor, I am sure that the right hon. Member for Chingford and Woodford Green (Sir Iain Duncan Smith), who has been bobbing, will not miss the wall when he asks the Secretary of State a question.

There is a bit of concern about the contractor, because it has previous when it comes to delivering Government contracts. Notably, there was a scandal over NHS business services and the running of immigration application systems. Given the seriousness of this issue for the Ministry of Defence, will the Secretary of State advise the House on whether he has confidence that the contractor is able to continue to deliver the contract? Will he consider a review of the specific armed forces payment network element and whether the contract should be brought back in-house and delivered by the MoD, rather than by some conglomerate based in Paris?

I can confirm that that review is already under way, and I can go further by saying that I am deeply interested in how this contractor, or indeed any other, behaves. I cannot jump straight to the conclusion of that research, and I do not think the hon. Gentleman would expect me to jump straight to the conclusion of a security review. To answer his question in a more straightforward way, if it were found that there is a better way to do this and we could not be satisfied on security, we would of course consider other options, such as those he suggested.

With one in five residents of Rutland being veterans or serving personnel, this news will be very concerning to our communities. In the last six weeks it has been concluded that the Chinese Communist party has been responsible for hacking our armed forces, for conducting a cyber-attack on the Electoral Commission and for cyber-attacks on French and British MPs; a German aide was arrested on espionage charges; and two British men were charged with obtaining information useful to an enemy. Attacking our institutions and the people who defend or represent our people is not the act of an ally or a friend, and the British police have explicitly deemed it the action of an enemy. So what is my right hon. Friend doing to make sure that we finally get a cross-Government consensus and get the Foreign Office to change our position on this matter? These are not the acts of a friend or ally; these are the actions of a country that considers itself anathema to our values, our activities and those who defend our interests.

My hon. Friend knows that we take the view that it is absolutely wrong for Members of Parliament to be in any way sanctioned by other countries—I know that she has been sanctioned; I have been sanctioned in other areas, although not by that particular country—and she is right to point out those cases that have been proven, including when the Deputy Prime Minister stood at the Dispatch Box recently and talked about electoral data. However, it is not the case in this circumstance—I do not want to mislead the House—that there is a proven connection. I stress that although we can see that a malign actor is involved, we have yet to make the full connection to a state. Although, as I pointed out in my statement, I cannot rule out that that might be the conclusion, but we have no evidence to conclude that yet.

When did the MOD last carry out an audit or review of the security precautions put in place to stop a cyber-attack with this contractor, if it did at all?

I can tell the House that, specifically for the MOD estate, we do that all the time—every day. With regard to this particular contract, I am aware that we have been in contact with the contractor about its cyber-security arrangements. For the purposes of national security, I cannot go into detail in the House, but I can perhaps provide the hon. Gentleman with a little further context separately, if that is helpful.

I welcome the fact that the helpline has been established so quickly, and I encourage the Government to be proactive in publishing advice on what people can do, for example to secure their bank accounts. What specialist advice does the MOD routinely seek before outsourcing data on service personnel to external contractors, and what standards must be verified before such outsourcing to a civilian organisation is allowed to take place?

It is obviously completely unacceptable for a contractor to leave our brave servicemen and women in this position, so we take it incredibly seriously and are very concerned by what has happened. My right hon. Friend asks about the checks that are in place. Of course, this contract long predates current Ministers, but we are checking through the details at considerable speed. As Members can imagine, we think the contractor has many questions to answer, and the ones that he asks will be included in them.

The Intelligence and Security Committee reported last year that the Government were not protecting the UK sufficiently against cyber-attacks, including from China and particularly against our armed forces. The Secretary of State says today that he is sorry, but why did he fail to listen?

As I mentioned a few moments ago, the MOD successfully defends against millions and millions of attacks each day. The threat is very real—we have that in common with all critical national infrastructure, other Departments and many businesses. That is one reason why the Government have committed to increasing defence spending to 2.5% of our GDP, with a timeline attached, so we will have more money to spend on defending against those attacks. It is one thing to wish for that defence but another to act, which is what we have done.

I welcome my right hon. Friend to the Dispatch Box. We know now that the British Government were warned by the American security services nearly two years ago that the Electoral Commission’s system had been hacked and that a number of MPs had been hacked. In the two-year period since, the Government have said nothing about China’s role—it was China, and they were warned at the time. In fact, we now know that far more MPs than we thought—nearly 40—were hacked, which was never reported at the time. I am concerned that the Government refuse to say who is responsible in this case, and that it may be another two years before we discover it or it is said publicly.

May I ask my right hon. Friend a very simple question? The FBI director has said that China has a cyber-espionage capacity so vast that it dwarfs everybody else’s, and we now know the record of all the direct attacks on us in the House, as the Chair of the Foreign Affairs Committee, my hon. Friend the Member for Rutland and Melton (Alicia Kearns), said. Given that the Deputy Prime Minister said in 2023 that the Government were considering placing the People’s Republic of China into the enhanced tier of the foreign influence registration scheme, why in heaven’s name do we not now place this malign actor in that tier and deal with it accordingly?