270,000 UK forces records thought to have been exposed to Chinese hackers

The defence secretary, Grant Shapps, is expected to brief MPs on Tuesday afternoon. Photograph: Neil Hall/EPA

An estimated 270,000 payroll records belonging to nearly all members of Britain’s armed forces have been exposed to Chinese hackers in a breach at a third-party contractor that was discovered a few days ago.

The data at risk includes names and bank details and, in a few thousand instances, addresses and national insurance numbers of current and recently departed members of the army, navy and air force, government sources indicated.

There is no immediate evidence that any data has been stolen or interfered with, but inquiries are continuing. Personnel are expected to be offered credit checks so people can monitor if their bank details have been used without permission.

Grant Shapps, the defence secretary, is expected to brief MPs on Tuesday afternoon on the situation and the steps being taken by the MoD to deal with the problem. Hackers are believed to have been present in the system for some time, possibly weeks.

An announcement had been planned on Tuesday, but details leaked overnight to the media before personnel were briefed, military sources said. Once the hack was discovered, the system was promptly taken offline.

Shapps is not expected to formally attribute the attack to China, but it is understood the hack was undertaken by actors from the country, the latest in a growing number of data breaches attributed to Beijing.

The Electoral Commission was hacked by Chinese actors in August 2021 and in March ministers held China responsible. The attackers gained access to copies of the electoral registers and broken into its emails and control systems.

Rishi Sunak, the prime minister, said China was “behaving in an increasingly assertive way abroad” and was “the greatest state-based threat to our economic security”. Parliamentarians critical of Beijing were also targeted, the government said.

The SAS and other special forces are understood to be paid separately, and so not affected. Some of the 270,000 records that affected by the breach are understood to be duplicates, so the actual number of people affected is likely to turn out to be lower.

A Ministry of Defence spokesperson said: “The defence secretary will make a planned statement to the House of Commons this afternoon setting out the multi-point plan to support and protect personnel.”

A spokesperson for the Chinese foreign ministry said Beijing opposed and fought all forms of cyber-attack and rejected using the issue for political ends to smear other countries.

A spokesperson for the Chinese embassy in London added: “China has always upheld the principle of non-interference in each other’s internal affairs. China has neither the interest nor the need to meddle in the internal affairs of the UK.

“We urge the relevant parties in the UK to stop spreading false information, stop fabricating so-called China threat narratives, and stop their anti-China political farce.”

Alfie Usher, an army veteran who runs Claims Bible, a military compensation specialist, said members of the armed forces should be vigilant.

“The MoD will offer a credit check software so people can keep an eye on new accounts being opened or any fraud alerts, along with individuals taking extra care when using their emails to avoid phishing scams,” he added.

Investigators, who include the government cybersecurity agencies GCHQ and NCSC, are also looking at “potential failings” by the contractors who ran the outsourced pay system on behalf of the MoD.

Forces pay is handled by SSCL, a subsidiary of the Paris-headquartered Sopra Steria. SSCL’s website says it provides core payroll, HR and pension services for 230,000 military personnel and reservists and 2 million veterans.

Sopra Steria has been approached for comment.