A Russian hacking software has been allegedly used to steal hundreds of Ministry of Defence computer log-ins in a major security breach.
The MoD is now investigating the incident which saw emails and passwords belonging to almost 600 employees – including UK Armed personnel, civil servants and defence contractors – being stolen and leaked on the dark web by cybercriminal groups since 2020. The stolen data includes email addresses, as well as other log-in information needed to access the MoD’s Defence Gateway portal, an online platform for British military personnel.
The system doesn’t contain classified information, but is used by some staff for communication and to get access to human resources and health data. The MoD told The Mirror that the system not an integral part of its operations and it is accessed via two-factor authentication.
It is believed most of the exposed employees are based in the UK, but some details of MoD staff based in Iraq, Qatar, Cyprus and mainland Europe have also been stolen, which could present a significant security risk. The incident was uncovered by the i newspaper, which was told by the MoD that they are constantly investigating the theft of credentials. According to the report, the majority of the data was stolen from staff using their personal devices to access the online platform.
There are now fears that hackers could also access sensitive information of MoD staff such as their private email accounts, online banking and social media profiles, putting them at potential risk of blackmail. One intelligence source told the newspaper: “This type of activity is often the first stage of a covert recruitment operation by adversaries.
“Stolen data provides hackers with personal information hostile actors can then use to coerce or blackmail employees who had viewed the stolen data said they believed it posed a greater risk to the individual rather than the institution.” They added: “There is a significant risk here of further blackmail to members of the armed forces using exfiltrated personal data. These are the new techniques used by adversaries to infiltrate the UK.”
A government spokesperson said: “We take a robust response to cyber threats which threaten our national interests and work round the clock to address vulnerabilities and protect critical services. It is important for individuals and organisations to remain vigilant against the risks posed by information theft.”
It comes after the head of MI6, Richard Moore, said Russia has launched a “staggeringly reckless” sabotage campaign against Ukraine’s Western allies including the UK. He said his agency and its French counterpart are battling to prevent a dangerous escalation by Moscow’s covert spooks.
Agencies like the Russian military intelligence wing the GRU are avenging a decision by Britain and France to allow Ukraine to use western-supplied missiles against targets in Russia. He said his officers are “calibrating the risk and informing the decisions of our respective governments” in response to President Vladimir Putin’s “mix of bluster and aggression.”
He explained: “We have recently uncovered a staggeringly reckless campaign of Russian sabotage in Europe, even as Putin and his acolytes resort to nuclear saber-rattling, to sow fear about the consequences of aiding Ukraine.” Moore was speaking to diplomats and intelligence officials in France. He added: “Such activity and rhetoric is dangerous and beyond irresponsible.” The veteran MI6 man spoke alongside Nicolas Lerner, head of France’s DGSE agency to mark the UK-France Entente Cordiale, a pact binding the age-old rivals.