Cyber attack on MoD workers 'fits Chinese 'pattern of behaviour'
A cyber attack targeting the financial information of 250,000 Ministry of Defence employees fits China’s ‘pattern of behaviour’ and could lead to blackmail attempts, a former spy chief warned today – as Beijing dismissed the claims as a ‘smear’.
The massive data breach targeted a third-party payroll system and potentially compromised the bank details of all serving personnel and some veterans. A very small number of addresses may also have been accessed.
Cabinet minister Mel Stride today said the MoD acted ‘very swiftly’ to take the external network – operated by a contractor – offline. The Government is understood to suspect China of being behind the breach but has not accused it publicly.
Ciaran Martin, the first CEO of the National Cyber Security Centre, said identifying the culprit would be a ‘long and complicated process’.
‘There’s a pattern of Chinese behaviour in the past that might lead one to suspect that China is responsible, but it certainly wouldn’t be the only suspect in a case like this,’ he told BBC Radio 4’s Today programme.
‘In terms of personal data sets, governments of all shapes and sizes are interested in the defence, and foreign ministries of governments. Criminals are interested in any data set they can get their hands on.’
China’s President Xi Jinping is on a two-day state visit to France – his first visit to Europe since 2019. Xi is pictured with his wife Peng Liyuan, President Macron and Brigitte Macron
Ciaran Martin, the first CEO of the National Cyber Security Centre, said identifying the culprit of the data breach would be a ‘long and complicated process’
Mr Martin said the attack was not as serious as a 2015 hack on US government security clearance records but remained worrying.
Asked if he could see how such an attack could lead to blackmail, he said: ‘That is absolutely the case and that is why perhaps not as serious as the incident in the US, it’s still of concern and we do worry about supply chain risk or the soft underbelly of professional services firms doing this type of thing, often more cheaply and efficiently than perhaps they’re done in government.
‘But that does require robust security procedures to be employed by the company and overseen by the sponsoring agency, in this case the MoD and clearly that’s something that’s going to have to be looked at in this case.’
China’s foreign ministry reacted to reports it was involved in the data breach by saying that it firmly opposes and fights all forms of cyber attack and rejected any attempt to use the issue to ‘smear’ other countries.
READ MORE: Macron is accused of ‘flattering tyrants’ and ‘rolling out the red carpet’ for Chinese President Xi Jinping as two leaders pose for photos with their wives at the Elysee Palace
Mr Stride, the World and Pensions Secretary, said the Government was not yet pinning the blame on Beijing.
He told Sky News, which first claimed China was behind the hack: ‘That is an assumption. We are not saying that at this precise moment.’
But Mr Stride said the Government viewed Beijing’s government as an ‘epoch-defining challenge’ and ‘our eyes are wide open when it comes to China’.
He confirmed the attack was on a third-party system rather than a MoD database but ‘nonetheless that’s still a very significant matter’.
The Government’s refreshed review of foreign and defence policy had cybersecurity ‘right at the heart of that, exactly these kinds of risks, particularly when it comes to state actors’.
It is understood that initial investigations have found no evidence that data has been removed.
But affected service personnel will be alerted as a precaution and provided with specialist advice. They will be able to use a personal data protection service to check whether their information is being used or an attempt is being made to use it.
All salaries were paid at the last payday, with no issues expected at the next one at the end of this month, although there may be a slight delay in the payment of expenses in a small number of cases.
The MoD confirmed Mr Shapps ‘will make a planned statement to the House of Commons this afternoon setting out the multi-point plan to support and protect personnel’.
Ministers will blame hostile and malign actors, but will not name the country behind the hacking.
President Xi in France yesterday. China’s foreign ministry has said suggestions it was involved in the data breach were a ‘smear’
The MoD has been working at speed to uncover the scale of the attack since it was discovered several days ago.
The attack was on a payroll system operated by an external contractor which contained details of current service personnel as well as a number of officials and veterans. Their names and bank details are among the information in the system.
The identification of Special Forces soldiers, who are entitled to lifelong anonymity, has not been compromised, according to defence sources.
Labour’s shadow defence secretary John Healey said: ‘So many serious questions for the Defence Secretary on this, especially from Forces personnel whose details were targeted.’
China’s President Xi Jinping is currently on a two-day state visit to France – his first visit to Europe since 2019.
Yesterday, he met French president Emmanuel Macron and called for a ‘worldwide truce’ on conflicts around the globe during the Olympic Games this summer.
The incident risks dissuading other countries with challenging relationships with China from sharing sensitive intelligence with the UK.
It comes less than two months after Chinese state-affiliated actors were blamed by the Government for two ‘malicious’ cyber attack campaigns in the UK.
Up to 250,000 people could be impacted by the breach with their names and bank details amongst the information that has been compromised
They involved an attack on the Electoral Commission in 2021 and on MPs sceptical of China.
It is understood that initial investigations have found no evidence that data has been removed.
But some of the MPs targeted by the Chinese state said the response did not go far enough, urging the Government to toughen its stance on China by labelling it a ‘threat’ to national security rather than an ‘epoch-defining challenge’.
Conservative former leader Sir Iain Duncan Smith repeated those calls, telling Sky News: ‘This is yet another example of why the UK Government must admit that China poses a systemic threat to the UK and change the integrated review to reflect that.
‘No more pretence, it is a malign actor, supporting Russia with money and military equipment, working with Iran and North Korea in a new axis of totalitarian states.’
Former defence minister Tobias Ellwood told the BBC’s Radio 4 Today programme: ‘Targeting the names of the payroll system and service personnel’s bank details, this does point to China because it can be as part of a plan, a strategy to see who might be coerced.’
In the Commons last month, Deputy Prime Minister Oliver Dowden confirmed that the Chinese ambassador would be summoned to ‘account for China’s conduct in these incidents’.
It comes less than two months after Chinese state-affiliated actors were blamed by the government for two ‘malicious’ cyberattack campaigns in the UK (file image)
He said the UK – alongside international partners including the US –would be issuing sanctions against the Chinese government.
Last night shadow defence secretary John Healey said: ‘So many serious questions for the Defence Secretary on this, especially from Forces personnel whose detail were targeted.
Any such hostile action is utterly unacceptable. Parliament will expect a full Commons statement.’
During Mr Xi’s visit, President Macron is expected to press the Chinese leader to lean on Russia to end the war in Ukraine, while Mr Xi said France and China should both aim to prevent a ‘new Cold War’ between global blocs.
It comes amid a European Union investigation into Chinese electric vehicle exports and a Beijing probe into French brandy imports.
Cyber attacks that have hit the UK
– March 2024
The UK and the United States accused China of a global campaign of ‘malicious’ cyber attacks in an unprecedented joint operation to reveal Beijing’s espionage.
Britain publicly blamed China for targeting the Electoral Commission watchdog and for being behind a campaign of online ‘reconnaissance’ aimed at the email accounts of MPs and peers.
The Electoral Commission attack was identified in October 2022, but the hackers had first been able to access the commission’s systems for more than a year, since August 2021.
– December 2023
A Foreign Office minister told the Commons that private conversations of high-profile politicians and civil servants were compromised by Russia’s principal security service during ‘sustained’ attempts to interfere in UK politics.
A cyber influence campaign by a group known as Star Blizzard, ‘almost certainly’ a subordinate of an FSB cyber unit, had ‘selectively leaked and amplified information’ since 2015.
– July 2022
The British Army confirmed a ‘breach’ of its Twitter and YouTube accounts. The channel featured videos on cyptocurrency and images of billionaire businessman Elon Musk.
The official Twitter account had retweeted a number of posts appearing to relate to NFTs (non-fungible tokens).
– July 2021
The UK accused the Chinese government of being behind ‘systematic cyber sabotage’ following a hacking attack which affected a quarter of a million servers around the world. The attacks, which took place in early 2021, targeted Microsoft Exchange servers.
– April 2021
Britain accused Russia’s foreign intelligence service of being behind a major cyber attack on the West.
The Foreign, Commonwealth and Development Office (FCDO) said the National Cyber Security Centre (NCSC) had assessed that it was ‘highly likely’ the SVR was responsible for the so-called SolarWinds hack.
– July 2020
Britain, the United States and Canada accused Russian spies of targeting scientists seeking to develop a coronavirus vaccine.
The three allies said hackers linked to Russian intelligence were seeking to steal the secrets of research bodies around the world, including in the UK.
Read more