Comments on MoD cybersecurity breach - Locks and Security News

Locks and Security News: your weekly locks and security industry newsletter
15th January 2025 Issue no. 736

Your industry news - first

We strongly recommend viewing Locks and Security News full size in your web browser. Click our masthead above to visit our website version.

Comments on MoD cybersecurity breach

The UK Ministry of Defence has suffered a significant data breach, where the personal information of military personnel has been hacked. A third-party payroll system, which includes names and bank details of current and past members of the armed forces, was targeted in the attack and has since been taken offline.

“Amid the unprecedented climate of international hostility and political disagreement, military objects and personnel will increasingly be targeted by cyber attacks sponsored or conducted by foreign nation-states. While few technical details are currently available about this specific data breach, it seems unlikely to be a fruit of foreign state interference. Attacks by foreign states usually aim at silently backdooring military networks, getting control over critical OT/ICS systems, or compromising classified military information.[TRIMTO

Financial and personal data of UK military personnel is a desired target for organized cybercrime groups that run large-scale fraud, scam and blackmailing campaigns over the Internet, being motivated by profits. Having said this, the attackers can, of course, try to re-sell information to more powerful hacking groups, backed by foreign states, to run laser-focused social engineering or extortion schemes against high-ranking officers of the British army. Thus, the risks should not be downplayed and urgent investigation is needed, however, there is no national security threat based on the information currently available.”
- Dr Ilia Kolochenko, CEO at ImmuniWeb and Adjunct Professor of Cybersecurity at Capital Technology University

“The personal details of military personnel have always been prized information for intelligence-gathering countries not afraid to get their hands dirty. The attack on a significant MoD payroll system is likely Nation-State backed, perpetrated by an Advanced Persistent Threat (APT) group. Be it China, or another suspect altogether, the attack has been carried out with purpose, accessing the outsourced system and finding this way more efficient and successful than a full frontal attack. It is worrying that the MoD became so susceptible through an ‘external contractor’, a sign that their attack surface management and supply chains needs urgent examination.

For the APT group responsible, it’s a show of power as to how easy it was to access some of the UK’s most secure data. As with the cyberattack on the royal family website last year, it’s clear Nation-State cyber groups are playing a long game, one of consistent, targeted attacks designed to disrupt our democracy. The MoD will need to reinstall public and private trust in the strength of its cybersecurity fast; it has quashed the threat which will now need to be identified and prevented in the future.”
- Guy Golan, CEO and Founder, Performanta

“This data breach affecting the personal information of the UK military personnel is the latest in a slew of attacks that further demonstrates the growing threat of cyber-attacks targeting nationally sensitive data.

The public sector has long been a prime target for cybercriminals, as evidenced by previous attacks on the NHS just last month. With over half of all organisations having experienced some form of cyber security breach or attack in the last year, there is a significant challenge faced by UK organisations in securing their systems.

What we see time and again is that the challenge is exacerbated by the presence of silos in cyber security monitoring, which can lead to gaps in threat detection and response. When different departments or systems operate in isolation, it becomes more difficult to identify and mitigate potential vulnerabilities, leaving organisations more susceptible to attacks.

In this context, the breach of personal information could lead to further targeted attacks, both in the digital and physical realm. When we consider the ongoing tensions in Ukraine and Israel, such attacks pose a wider risk to MoD operations in the area.

As investigations into this breach unfolds, it’s clear that the UK’s cybersecurity posture needs to evolve to meet the growing threat landscape. This will require a concerted effort to break down silos and foster greater collaboration between departments, agencies and the private sector.

Organisations must create a more cohesive and integrated approach to cybersecurity where information is shared freely and teams work together to identify and respond to threats.”
- Martin Greenfield, CEO, Quod Orbis