Shapps to update MPs on hack targeting defence payroll details

Defence Secretary Grant Shapps will update MPs on a cyber attack on a database containing details of armed forces personnel amid reports China was behind the hack.

A third-party payroll system has been hacked, potentially compromising the bank details of all serving personnel and some veterans. A very small number of addresses may also have been accessed.

The Ministry of Defence (MoD) took immediate action when it discovered the breach, taking the external network – operated by a contractor – offline.

Downing Street said the Government had also launched a security review of the contractor’s operations.

But the Prime Minister’s official spokesman declined to comment on speculation about the origin of the attack ahead of a planned statement to the Commons on the incident by Defence Secretary Grant Shapps, saying only that the MoD had “acted immediately” to isolate the relevant network and support personnel affected by the incident.

Mr Shapps is not expected to attribute the attack to a specific state or actor when he addresses MPs on Tuesday afternoon.

Cabinet minister Mel Stride said the Government takes cybersecurity “extremely seriously” but also declined to place the blame on Beijing.

He told Sky News, which first claimed China was behind the hack: “That is an assumption. We are not saying that at this precise moment.”

But Mr Stride said the Government viewed Beijing’s government as an “epoch-defining challenge” and “our eyes are wide open when it comes to China”.

Mr Stride confirmed the attack was on a third-party system rather than a MoD database but “nonetheless that’s still a very significant matter”.

The Ministry of Defence acted “very swiftly” to take the database offline, he added.

“We take cybersecurity extremely seriously. Our intelligence services do, our military does as well.”

The Government’s refreshed review of foreign and defence policy had cybersecurity “right at the heart of that, exactly these kinds of risks, particularly when it comes to state actors”.

It is understood that initial investigations have found no evidence that data has been removed.

But affected service personnel will be alerted as a precaution and provided with specialist advice. They will be able to use a personal data protection service to check whether their information is being used or an attempt is being made to use it.

All salaries were paid at the last payday, with no issues expected at the next one at the end of this month, although there may be a slight delay in the payment of expenses in a small number of cases.

The MoD confirmed Mr Shapps “will make a planned statement to the House of Commons this afternoon setting out the multi-point plan to support and protect personnel”.

Ministers will blame hostile and malign actors, but will not name the country behind the hacking.

The MoD has been working at speed to uncover the scale of the attack since it was discovered several days ago.

Labour’s shadow defence secretary John Healey said: “So many serious questions for the Defence Secretary on this, especially from Forces personnel whose details were targeted.”

A spokesperson for the Chinese embassy said claims Beijing was behind the attack were “completely fabricated and malicious slanders”.

They said: “China has always firmly fought all forms of cyber attacks according to law.

“China does not encourage, support or condone cyber attacks. At the same time, we oppose the politicisation of cybersecurity issues and the baseless denigration of other countries without factual evidence.

“China has always upheld the principle of non-interference in each other’s internal affairs. China has neither the interest nor the need to meddle in the internal affairs of the UK.

“We urge the relevant parties in the UK to stop spreading false information, stop fabricating so-called China threat narratives, and stop their anti-China political farce.”

The revelation comes after the UK and the US in March accused China of a global campaign of “malicious” cyber attacks in an unprecedented joint operation to reveal Beijing’s espionage.

Britain blamed Beijing for targeting the Electoral Commission watchdog in 2021 and for being behind a campaign of online “reconnaissance” aimed at the email accounts of MPs and peers.

In response to the Beijing-linked hacks on the Electoral Commission and 43 individuals, a front company, Wuhan Xiaoruizhi Science and Technology Company, and two people linked to the APT31 hacking group were sanctioned.

But some of the MPs targeted by the Chinese state said the response did not go far enough, urging the Government to toughen its stance on China by labelling it a “threat” to national security rather than an “epoch-defining challenge”.

Conservative former leader Sir Iain Duncan Smith repeated those calls, telling Sky News: “This is yet another example of why the UK Government must admit that China poses a systemic threat to the UK and change the integrated review to reflect that.

“No more pretence, it is a malign actor, supporting Russia with money and military equipment, working with Iran and North Korea in a new axis of totalitarian states.”

Former defence minister Tobias Ellwood told the BBC’s Radio 4 Today programme: “Targeting the names of the payroll system and service personnel’s bank details, this does point to China because it can be as part of a plan, a strategy to see who might be coerced.”