UK suspects China behind cyber attack on military personnel data

The UK government suspects that China is behind a cyber attack targeting the names and bank details of up to 270,000 current and former British military personnel, according to a person with direct knowledge of the matter.

The hack, which accessed a UK Ministry of Defence contractor’s IT system that was not linked to the MoD’s central network, was discovered in recent days.

Hackers accessed a system containing the names and bank details of all serving regular military personnel and reservists, as well as several thousand veterans. A small number of addresses were also on the system.

An initial investigation by the MoD found that while the system had been breached, there was no evidence that any personal information had been copied or “removed” from it. Precautions are being taken in case personal data was copied, however.

SSCL is the contractor that manages the MoD’s military personnel payroll, according to a person briefed on the matter. Sopra Steria, which owns SSCL, has been contacted for comment.

Cabinet minister Mel Stride on Tuesday confirmed that a cyber attack had taken place against a third-party payroll system used by the MoD, telling Sky News, which first reported the hack, that it was a “very significant matter”. He said the department had acted “very swiftly” to take the system offline.

Stride declined to comment on whether the UK had pinpointed China as the hostile actor behind the hack, saying: “That is an assumption. We are not saying that at this precise moment.”

The UK government views the Beijing regime as an “epoch-defining challenge”, he said, adding that “our eyes are wide open when it comes to China”.

Grant Shapps, defence secretary, will make a statement about the hack to MPs later on Tuesday. He is set to confirm indications that a hostile state was responsible, but the UK government is not expected to publicly name China.

However, a person with direct knowledge of the hack said that the UK government suspected Beijing was behind the cyber attack.

John Healey, Labour’s shadow defence secretary, said on X there were “so many serious questions” for Shapps to answer, including from forces personnel whose details were targeted.

Tory MP Tobias Ellwood, a former defence minister, told the BBC: “Targeting the names of the payroll system and service personnel’s bank details, this does point to China because it can be as part of a plan, a strategy to see who might be coerced.”

The Cabinet Office, the department that runs the machinery of government, intelligence agencies and private security specialists have been called in to assist with the MoD investigation.

A private security company has also been commissioned to monitor the internet in case any information has been successfully removed from the contractor’s IT system and is leaked online.

Monthly salary payments to military personnel will not be affected. The personal details of UK special forces personnel are kept on a different IT system and have not been affected.

Members of the armed forces will be informed about the cyber attack on Tuesday, as the MoD seeks to reassure individuals potentially affected that their safety is not at risk.

The MoD will offer advice and welfare support, and set up a call centre to deal with questions.

It comes after the US and UK in March unveiled sweeping measures against hackers backed by China’s government, alleging they carried out extensive cyber attacks against targets in Washington and London.

Lin Jian, a Chinese foreign ministry spokesperson, said on Tuesday: “The comments made by British politicians are purely absurd. China consistently resolutely opposes and combats all forms of cyber attacks, and firmly opposes the deliberate smearing of other countries for political purposes by using cyber security issues.”

A MoD spokesperson said on Tuesday: “The defence secretary will make a planned statement to the House of Commons this afternoon setting out the multi-point plan to support and protect personnel.”