Defence Personnel Data Breach

Jeremy Quin Excerpts

Tuesday 7th May 2024 Commons Chamber

[Grant Shapps]

I thank the right hon. Gentleman for his words about the united way in which this House tackles such issues, and there is much of what he says that I can agree with. He asked a number of questions and I will try to rattle off some responses to him.

The chosen date to announce this breach was today, to ensure that we would be able to secure the systems, back up and make sure everyone had their payments made, even if it was not through those systems. The media release last night was coincidental and unwelcome, as far as we were concerned, but unfortunately a lot of people are involved in this. He asked how many personnel had been affected, and the number is 272,000. I stress that that means it is up to that number; the number is still being refined and will probably end up lower, but none the less it is a large number of people and they may have noticed that bank payments were not made, so some of the media will have picked up on that.

The right hon. Gentleman is right to say that the welfare of our personnel is our absolute first priority. I hope that he will agree that the eight-point plan focuses heavily on that and consists of ensuring that they are getting every bit of help and support required. Although we do not think the data is necessarily stolen, we are making the assumption that it has been in order to ensure that personnel get the support required, including through their own data monitoring services, which we are providing to each and every one of them, whether or not they are affected in this particular case.

The right hon. Gentleman has named the contractor involved, and I can confirm that that is the correct name, SSCL. As I mentioned in my statement, we have not only ordered a full review of its work within the MOD, but gone further and requested from the Cabinet Office a full review of its work across Government, and that is under way. I also briefly mentioned specialists being brought in to carry out a forensic investigation of the way this breach has operated.

Data breaches and this level of attack are nothing new, but the right hon. Gentleman is right to point out, and the House will be aware, that these attacks are growing, to the extent that the MOD’s networks are under attack millions of times per day, and they successfully repel those attacks millions of times per day. I stress again, particularly for servicemen and women listening, that this breach does not contain data that is on main MOD systems, and which is of even greater concern to us. It is right that we invest in protecting the systems to ensure that these data attacks are repelled and are not successful.

I would gently say to the right hon. Gentleman, as I think he might expect me to, that one of the best ways to do that is to invest in defence. That is why we are committed to a 2.5% increase, with a fixed timeline and a plan to pay for it, because it means we will be able to do more things, including investing further in cyber-security.

[Sir Jeremy Quin (Horsham) (Con)]

SSCL was a joint venture with the Cabinet Office—I think there was a legacy minority stake held until last year. As is public, it also provides services to, from memory, the Metropolitan police, the Home Office and the Ministry of Justice. I welcome the Secretary of State’s remark that the investigation will be across Government, because absolutely all areas of Government that are exposed need to be doing the necessary. What specialist support is he receiving from elsewhere in Government, and when might the malign actor be named?

[Grant Shapps]

As my right hon. Friend will know, the process of getting towards naming—if, indeed, a state-sponsored actor is involved—is a specific process set out by the Butler reforms, and it does take some time to reach such conclusions.

My right hon. Friend asked specifically about the ongoing work with the particular contractor. The Cabinet Office is calling in specialist analysts who will carry out that work over the coming weeks. There are two separate tracks in respect of the contractor in the MOD but also, separately, in the different places across Government that my right hon. Friend rightly identified. I stress to the House—because I suspect that this will be brought up a number of times—that we expect very high standards from our contractors that work with the lives and livelihoods of our service personnel, so we will take all appropriate actions.