On 6 May, news broke that the details of 270,000 service personnel working for the UK Ministry of Defence (MOD) had been accessed. It was part of a cyber-espionage operation targeting a contractor responsible for managing the MOD’s payroll system.
In a statement to parliament, the UK’s defence secretary Grant Shapps said that the data breach was suspected to be the work of a malign actor and state involvement could not be ruled out.
Although the government did not officially attribute this data breach, many MPs pointed fingers at China, recalling its track record in cyber espionage – a significant and long-standing issue for many Western countries.
A similar data breach occurred in 2014 at the US Office of Personnel Management (OPM), a government agency overseeing the federal workforce, but on a significantly larger scale. The breach was detected in 2015 and the perpetrators used a third-party contractor as the initial point of entry into OPM’s network.
It was one of the largest breaches of government data in US history, affecting 22.1 million individuals. China was identified as the perpetrator. Shortly after, during a state visit hosted by President Barack Obama for President Xi Jinping, both leaders agreed that ‘neither country’s government will conduct or knowingly support cyber-enabled theft of intellectual property, including trade secrets or other confidential business information’.
However, this agreement mainly related to espionage aimed at giving competitive advantages to companies or commercial sectors.
Understandably, the UK government would be careful this early in the investigation about attributing the attack to China or any other state – or indeed to a non-state actor, like a criminal group.
The government needs to gather substantial evidence and reach a high level of certainty before making any definitive statements.
Earlier this year, the UK accused China of conducting a global campaign of malicious cyberattacks and issued sanctions against Chinese companies and individuals. Among the targets between late 2021 and October 2022 was the UK electoral commission.
Attribution of that attack was officially made in March 2024, more than two years after it occurred. This underscores the often lengthy process involved in making such attributions and agreeing on appropriate punitive actions.
Questions over MOD’s contracting processes
Both the MOD data breach and the OPM incident involved a malicious actor gaining access to sensitive information through a third-party contractor. However, unlike the OPM breach, the contractor’s system was not linked to the MOD’s central network. Additionally, the MOD breach was notably smaller in scale.
Nonetheless, both incidents highlight the critical issue of supply chain security. Shortly after the MOD breach, a multi-step plan was enacted, detailed by the defence secretary to parliament.
This plan included taking the compromised system offline, launching an investigation, notifying affected personnel, providing support to potentially impacted individuals, and suspending payment processing.
In his speech, the defence secretary highlighted that ‘potential failings’ by contractors operating the payroll system may have facilitated access for the malicious actor. Yet the MOD cyberattack prompts questions about the processes within the ministry for governing external contractor provision and ensuring compliance with security requirements.
Supply chain security, especially for sensitive institutions like the MOD, has been a concern for several years, driven by high-profile incidents like the SolarWinds hack. This attack, which occurred in 2020 and was later attributed to Russia’s Foreign Intelligence Service, was considered one of the largest and most sophisticated hacks.
It affected numerous organizations worldwide, including many US and UK government agencies, NATO and the European Parliament.
The attack was a supply chain attack where hackers exploited vulnerabilities from at least three US firms – Microsoft, SolarWinds and VMware – allowing them access to sensitive data in organizations using these softwares. Many lessons were learned, leading to a heightened focus on supply chain security, especially within government agencies.
The presence of third-party contractors and vendors in the supply chain of large and complex organizations like the MOD is almost inevitable. The complexity creates interdependencies, making it challenging to ensure security at all times.
Having multiple parties in the supply chain increases the potential points of vulnerability, requiring comprehensive security measures and practices to mitigate risks effectively.
Protect data ‘crown jewels’ against cyberthreats
When it comes to data protection, any organization should identify its ‘crown jewels’ – namely, the most critical and sensitive data assets that require the highest level of protection. This involves categorizing data based on its importance and the potential impact if compromised.