Defence Personnel Data Breach

Jesse Norman Excerpts

Tuesday 7th May 2024 Commons Chamber

[Grant Shapps]

It is certainly true to say that a malign actor is involved—we know that. It is possible, and I cannot rule it out, that it is attached to a country, but as soon as I say that everyone assumes it therefore is attached to a country. I am not in a position to confirm that at this point, simply because incredibly detailed forensic work is required to get to that point. My right hon. Friend is right that people differentiate, in some senses, between physical attacks and cyber-attacks, but both can be incredibly serious and have enormous consequences. Again, because we do not believe that the information has, in fact, been stolen and because we are monitoring it very carefully through the eight different measures, I stress that in this case there is a degree of feeling that we have caught it and we are controlling it. However, my right hon. Friend’s wider point is absolutely correct.

[Jesse Norman (Hereford and South Herefordshire) (Con)]

The Secretary of State has been clear about the serious nature of the breach; he has said so several times from the Dispatch Box. He has also said that the contractor failed to follow MOD guidelines and therefore is culpable, to some degree, as far as we can see so far. What sanctions are in place to penalise that contractor? What sanctions will the Secretary of State apply at the limit if that contractor is found to be in breach? Finally, he mentioned addresses. Roughly how many addresses have potentially been leaked? I am deeply concerned not just about bank details but about the safety and wellbeing of those soldiers.

[Grant Shapps]

I share my right hon. Friend’s concern about the safety and wellbeing of those soldiers. Thankfully, the answer is that very few addresses have been leaked—a very tiny number. On sanctions and what will happen, we must not jump the order of events. We have to be confident we are able to run through the audit trail of exactly what has happened. However, I again make it clear from the Dispatch Box that if negligence has been involved, then we will take the strongest possible action as a result. He and the whole House understand that that is our concern this afternoon.