Loading story…
The UK Ministry of Defence disclosed that a malign actor accessed part of an armed forces payment network operated by an external contractor, exposing personal data for serving personnel, reservists, and some recently retired veterans. The compromised records included names and bank details and, in a smaller number of cases, home addresses; reporting also cited National Insurance numbers among the exposed information. The affected platform was described as separate from the MoD’s core network and main military HR systems, and the government said no operational defence data was obtained.
The MoD took the contractor-run system offline, halted payment processing on that platform, opened a full investigation, and began notifying affected individuals while offering helplines, monitoring, welfare, and financial support. Ministers said they could not rule out state involvement and were examining potential failings by the contractor that may have enabled the intrusion, while broader commentary on the incident highlighted the supply-chain risk posed by third-party service providers, the possibility that attackers remained undetected for weeks, and the heightened personal safety risks that exposed military identities and locations can create, including fraud, harassment, blackmail, and targeting.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
Alongside the public disclosure, the government said a specialist security review of the contractor was under way and announced a broader review of personnel data networks. The response formed part of an eight-point plan following the breach.
The UK government publicly disclosed the incident, stating that a malign actor had accessed a contractor-managed payment network containing armed forces personnel data. Officials said they could not rule out state involvement and were investigating possible contractor failings that may have enabled the breach.
The Ministry of Defence started notifying affected service members and some veterans as a precaution and coordinated support through veterans' organisations. It also put in place response measures including a helpline, data protection monitoring, and welfare and financial support.
After discovering the intrusion, the Ministry of Defence took the contractor-operated payroll system offline, halted payment processing on that platform, and began a full investigation. The department said the affected environment was separate from the MOD core network and main military HR system.
A threat actor gained access to part of an armed forces payment network operated by an external contractor serving the UK Ministry of Defence. The compromised system held personal data for serving personnel, reservists, and some recently retired veterans, including names, bank details, and in fewer cases addresses.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
5 references tracked. Mallory keeps watching after this page renders.
securitysenses.com
Open sourcetheguardian.com
Open sourcebbc.co.uk
Open sourcehansard.parliament.uk
Open sourcebbc.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A data breach at the UK Ministry of Defence in February 2022 exposed the personal details of approximately 19,000 Afghan citizens who had assisted British forces, as well as some senior British officials and spies. The leak, which was not discovered until part of the list was published online in August 2023, resulted in the Taliban targeting those named, leading to direct threats, home raids, and, in many cases, the deaths of family members and colleagues. Research by Refugee Legal Support, supported by UK academics, found that 49 individuals reported losing family or colleagues due to the breach, and nearly 100 reported direct threats to their own lives. The majority of those affected have not been offered relocation to the UK, leaving them and their families at continued risk. The Information Commissioner's Office fined the Ministry of Defence £350,000 for a previous, smaller breach in 2021, but the 2022 incident is considered one of the UK's most damaging data protection failures. The Taliban have used the leaked information to systematically hunt down those who aided Western forces, with 87 percent of surveyed victims reporting personal risks and over 100 reporting home raids. The UK government responded by securing a super-injunction to limit reporting on the breach, but the ongoing intimidation, violence, and lack of adequate support for those affected highlight the severe human cost of the incident.
Jul 12, 2026
Personal data for more than **100,000 UK police officers and staff** was reportedly leaked on the dark web after a major breach affecting multiple government bodies. Exposed information included **full names and contact details**, with reporting indicating the incident also impacted the **Ministry of Defence**, **Home Office**, **National Crime Agency**, and **Crown Prosecution Service**, adding to concerns over the exposure of sensitive law-enforcement and government personnel records. The intrusion has been attributed in reporting to the cybercriminal group **ExfilSquad**, which allegedly listed the victims on its leak site and claimed the access stemmed from **Microsoft Power Apps** and **Dynamics 365** misconfigurations. Specifically, the group said improperly configured permissions on **Dataverse** tables enabled the data exposure, and the breach was reported after a separate recent compromise involving the **Department for Education**.
Aug 4, 2026
Unauthorized users exploited a vulnerability in the Defense Manpower Data Center's file-sharing system, accessing unencrypted personnel files from about October 2025 until the flaw was detected on July 16, 2026. The breach may affect roughly 4 million current and former Department of Defense personnel. Exposed information reportedly includes names, dates of birth, contact and demographic data, unencrypted Social Security numbers, and in some cases military occupational specialty or equivalent role codes. DMDC remediated the vulnerability and restored the affected system, detecting and containing the intrusion in July before notifying individuals on September 18. It offered 12 months of IDX credit-monitoring and identity-restoration services; no malicious use had been reported at publication. The incident has not been attributed, and the exploited vulnerability has not been disclosed, but the combination of identity data and military-role information creates substantial identity-fraud and counterintelligence risk, potentially enabling adversaries to identify and target service members, veterans, and their families.
Sep 28, 2026