In a significant cyber incident that has alarmed the British defence community, Russian hackers reportedly breached UK Ministry of Defence (MoD) data systems, accessing and stealing sensitive information relating to military personnel and operational bases. According to reports from British media, the cybercriminals infiltrated the systems of Dodd Group, a maintenance and construction contractor for the MoD, through a ransomware attack that granted them temporary access to internal networks. While the contractor confirmed the security breach and ongoing forensic investigation, claims emerged that personal data belonging to some 272,000 service members and veterans—including names, bank details, and addresses—were taken and posted online.

The stolen files purportedly included details about key military locations such as RAF Lakenheath, home to US Air Force F-35 jets, and various Royal Navy bases. The British Ministry of Defence acknowledged the incident and stated it was investigating allegations that classified information had been published on the Dark Web. However, to protect operational security, the MoD declined to comment further on specifics.

This attack fits into a broader pattern of escalating cyber threats against UK military infrastructure in recent years. The Defence Gateway portal, a critical platform for British military staff, was targeted in a separate 2024 cyberattack that resulted in nearly 600 employees’ passwords being leaked online. This earlier breach compromised sensitive login credentials and raised concerns among intelligence experts about potential espionage, including recruitment or blackmail attempts connected to these cyber intrusions.

More broadly, state-sponsored cyberattacks have increasingly targeted the UK’s defence sector. In April 2024, a massive data breach involving the third-party payroll system SSCL exposed names and bank information of thousands of military personnel. Although the government did not publicly confirm the perpetrators, media sources speculated that the attack involved a state-backed actor, with allegations pointing towards Chinese hackers.

Other notable incidents include a September 2023 breach by the Russian-linked LockBit hacking group, which accessed substantial data from Zaun, a provider of fencing for high-security sites. Among the compromised information were details related to the UK’s nuclear submarine base at HMNB Clyde, the Porton Down chemical weapons facility, and GCHQ communications infrastructure. LockBit’s administrator, Dmitry Yuryevich Khoroshev, was indicted by US authorities in October 2024, facing charges from multiple international law enforcement bodies. Despite these efforts, the threat posed by such groups remains substantial, especially if actors remain shielded by operating from within Russia.

In October 2025, the UK Ministry of Defence launched another investigation following claims that the Russian hacker group Lynx accessed and leaked hundreds of sensitive military documents. The breach reportedly involved a 'gateway' attack through an MoD contractor, circumventing advanced cyber defences.

Despite these ongoing challenges, the UK government has sought to bolster its cyber resilience. A foiled cyber espionage operation in May 2025, where Russian-linked hackers posing as journalists attempted a spear-phishing attack against MoD staff, highlighted the persistent risks. Subsequently, Defence Secretary John Healey announced steps towards enhancing the UK military’s offensive cyber capabilities, in line with the Strategic Defence Review due for publication in June 2025.

These cumulative events underscore the complex and persistent nature of cyber warfare targeting UK military interests, revealing vulnerabilities in both direct military systems and associated contractor networks. They also highlight the intersecting threats from state-backed hackers and criminal groups, prompting ongoing efforts toward improved cyber security and countermeasures within the defence sector.

📌 Reference Map:

Source: Noah Wire Services