IT contractor failed to report MoD data hack for months

The information technology company targeted in a Chinese hack that accessed the data of hundreds of thousands of Ministry of Defence staff failed to report the breach for months, the Guardian can reveal.

- Anna Isaac, Dan Sabbagh

The defence secretary, Grant Shapps, told MPs on Tuesday that Shared Services Connected Ltd (SSCL) had been breached by a malign actor and "state involvement" could not be ruled out.

Shapps said the payroll records of about 270,000 current and former military personnel, including their home addresses, had been accessed. China has not been openly named by the government as the culprit.

The MoD was told of the hack in recent days but a number of sources said SSCL, an arm of the French tech company Sopra Steria, had become aware of the breach in February.

Sopra Steria did not respond to requests for comment.

One Whitehall insider did not comment on the timeframe but said concern about SSCL being "slow to respond" was among issues being examined by an official inquiry.

It can also be revealed that SSCL was last month awarded a contract worth more than £500,000 to monitor the MoD's own cybersecurity - several weeks after it was hacked.

Officials now believe this contract could be revoked.