Defence Personnel Data Breach

Lord Lancaster of Kimbolton Excerpts

Wednesday 8th May 2024 Lords Chamber

[Lord Harlech (Con)]

I thank the noble and gallant Lord for his question. The information that was compromised in this was names, bank details and, in some cases, addresses. We are working at speed, as part of the investigation, to ascertain exactly whose information and what information have been breached, and to contact them through all methods of communication that we have on file for them. It will not be the case that we use just one avenue; we will be doing everything we can to contact them in the most expedient way possible.

[Lord Lancaster of Kimbolton (Con)]

My Lords, following the declaration of interest from the noble and gallant Lord, Lord Craig, I fear that I should also declare an interest as a lowly two-star officer who has definitely been affected by this data breach—as indeed has the Minister, although he may not have said that.

I commend the Government’s response. I awoke this morning to a very comprehensive email in my MoD inbox explaining exactly what had happened and what I should do about it. I would, however, like to make one point following what the noble Baroness said. When I accessed the commercial data protection service, the first thing it asked me to do was to submit all my bank account details from my various bank accounts. The Minister will understand that I was slightly reluctant to do that in the circumstances.

My serious question is one that is very much doing the rounds among the Armed Services. If, while no data appears to have been harvested, subsequently data is harvested and we see money removed from bank accounts, where will the liability fall?

[Lord Harlech (Con)]

My noble friend—“General”, “Sir”—raised a number of very important points. He is, as always, ahead of me. In preparing for this Statement, I have not yet gone through my notifications to see what steps I should be taking next.

This is a very serious issue and that is why we have acted in the way we have. We take data responsibility extremely seriously. That is why, as soon as we became aware of the incident, we stopped the processing of all payments and isolated the network, enabling us to review what happened. As I said in the follow-up to the Statement, pay runs have been unaffected, including monthly salaries and larger payments. We understand that this is a distressing time for service personnel. I would like to reassure them and all noble Lords that we are dealing with this matter with the utmost seriousness and haste.