China suspected of massive cyberattack on database of UK armed forces personnel

A massive Chinese cyberattack targeted the UK’s Ministry of Defence in a breach revealing the details of armed forces personnel, according to reports.

The attack, believed to have been done two or three times, was on a third-party payroll system including the details of tens of thousands of British armed forces and veterans.

The MoD has been working over the last three days to understand the scale of the hack, after it was recently discovered, Sky News reported. The Ministry of Defence was approached for comment.

It is not believed any data was taken and the MoD urged service people not to be concerned for their safety. MPs will be told about the attack on Tuesday.

It comes after Chinese “state-affiliated actors” were blamed by the government for two “malicious” cyberattack campaigns in the UK between 2021 and 2022.

In March, deputy prime minister Oliver Dowden told the House of Commons two individuals and a company linked to the Chinese state had been sanctioned over attacks on the Electoral Commission.

The same company also carried out “reconnaissance” activity against UK parliamentary accounts in a separate campaign in 2021, Mr Dowden said.

Mr Dowden told MPs that the UK was putting sanctions on two people and a company associated with the cybergroup APT31, which is linked to the Chinese Ministry of State Security.

At the time, a spokesperson for the Chinese embassy in London said: “The so-called cyberattacks by China against the UK are completely fabricated and malicious slanders.”

On Monday, Chinese president Xi Jinping began a tour of Europe, although he was not set to visit the UK. He spent the day in Paris, where he met French president Emmanuel Macron.

Upon his arrival, a group of seven French lawmakers targeted by cyberattacks attributed to Chinese hackers called for a judicial investigation by the authorities.

They want France to formally attribute the attack to APT31 – the same company sanctioned by Britain in March.

Unlike the US, UK and New Zealand, which have formally accused China for several cyberattacks, French authorities have shied away from accusing Beijing.

Mr Xi will visit Serbia on Wednesday and Hungary on Thursday – both countries which are on friendly terms with the Chinese state.