Defence Personnel Data Breach

James Gray Excerpts

Tuesday 7th May 2024 Commons Chamber

[Grant Shapps]

That was creative, if nothing else. The fact that we paid a nearly 10% pay increase—9.7% last year—to many ranks of our armed forces, and that the Conservative party has committed to spending 2.5% of GDP, which is a pledge I have not heard repeated by the Opposition, rather suggests that we are prepared to do something about pay and retention.

[James Gray (North Wiltshire) (Con)]

I very much welcome the great seriousness with which the Secretary of State is taking this appalling data breach, because it really has been awful. I too am convinced that the prime contractors have very significant cyber-security requirements, so it is extremely unlikely that a prime contractor would be hacked in this way. My understanding is that subcontractors and sub-subcontractors down the food chain do not have the same level of cyber-control. We have something called the Cyber Essentials accreditation, but even that is not compulsory. Will the Secretary of State look at the way subcontractors and sub-subcontractors are checked for cyber-security and make that accreditation compulsory rather than voluntary?

[Grant Shapps]

The concerning thing about this particular incident is that SSCL is a primary contractor, rather than a subcontractor, but my hon. Friend is absolutely right to raise the wider issue. The answer is yes: our intention—indeed, our instruction—is to go right the way through. As I said in my initial comments, we take this incredibly seriously. It is unacceptable that it happened, and we will take every possible measure, once we have got to the forensic truth of what happened, including against the contractor and any subcontractors.