The Guardian-MoD contractor hacked by China failed to report breach for months
May 10, 2024 4 min 650 words
英国《卫报》报道，一家名为Shared Services Connected Ltd SSCL 的IT公司遭到黑客攻击，导致英国国防部数十万工作人员的数据被泄露，而该公司在数月后才报告这一事件。英国国防大臣格兰特沙普斯透露，大约27万名现役和退役军人的薪资记录及其家庭住址可能已被访问，并暗示中国是这次黑客攻击的幕后黑手。报道还提到，SSCL在遭到黑客攻击后，还获得了价值50万英镑的监测英国国防部网络安全的合同，而该公司此前就多次出现对网络安全威胁反应迟缓的情况。此外，SSCL和中国之间可能存在一些未披露的网络安全合同。中国大使馆否认了对黑客攻击的指控，称英国有关方面停止散布虚假信息，停止炮制中国威胁论。 评论： 该报道存在明显偏见，其行文和措辞明显带有指控中国的倾向，试图将中国塑造成网络安全威胁。然而，报道所提供的证据较为薄弱，更多的是依赖匿名消息源和暗示。此外，报道也忽略了一些关键细节，例如仅凭薪资记录和住址等信息，难以对军事人员造成实质性威胁。同时，报道也忽略了其他国家，尤其是西方国家在网络间谍活动方面的大量投资和行动。虽然网络安全威胁确实存在，但将矛头直接指向中国，并忽略自身问题，显然是不客观和有失偏颇的。该报道也反映出一些西方媒体在报道涉华新闻时往往缺乏公正性和客观性，倾向于炒作和抹黑中国，这无助于公众对事件真相的了解，也无益于改善中美关系和国际关系。
The IT company targeted in a Chinese hack that accessed the data of hundreds of thousands of Ministry of Defence staff failed to report the breach for months, the Guardian can reveal.
The UK defence secretary, Grant Shapps, told MPs on Tuesday that Shared Services Connected Ltd (SSCL) had been breached by a malign actor and “state involvement” could not be ruled out.
Shapps said the payroll records of about 270,000 current and former military personnel, including their home addresses, had been accessed. China has not been openly named by the government as the culprit.
The MoD was told of the hack in recent days but a number of sources said SSCL, an arm of the French tech company Sopra Steria, became aware of the breach in February.
Sopra Steria did not respond to requests for comment.
One Whitehall insider did not comment on the timeframe but said that concern about SSCL being “slow to respond” was one of the issues being examined in an official inquiry into the hack.
It can also be revealed that SSCL was awarded a contract worth more than £500,000 in April to monitor the MoD’s own cybersecurity – several weeks after it was hacked. Officials now believe this contract could be revoked.
The payroll data that was hacked reflects only a fraction of the work SSCL does for the government.
Sopra Steria and SSCL are understood to have other undisclosed government cybersecurity contracts, according to Whitehall sources. However, these are deemed so sensitive that they have never been publicly disclosed. The Cabinet Office declined to comment on the detail of contracts, citing security restrictions.
The cybersecurity arm of the UK’s intelligence services, the National Cyber Security Centre, has warned of a growing threat to the country’s businesses and critical national infrastructure from hostile states. Chinese and Russian state-sponsored actors were highlighted among attackers using a range of routes to try to hide malicious activity on networks containing sensitive information.
Whitehall worries over a lack of transparency by SSCL have raised concerns that there could be a wider compromise of its systems. Sopra Steria is one of a handful of strategic suppliers to the government, with work ranging from administering pensions to wider payments systems for government departments and agencies.
Shapps told parliament that the government had “not only ordered a full review of its [SSCL’s] work within the MoD, but gone further and requested from the Cabinet Office a full review of its work across government, and that is under way”. He added that specialists had been brought in to carry out a “forensic investigation” of how the breach happened.
Earlier this week, a spokesperson for the Cabinet Office said: “An independently audited, comprehensive security review of the contractor’s operations is under way and appropriate steps will be taken based on its findings.”
SSCL was part-owned by the government until October last year when it sold its 25% stake to Sopra Steria for £82m. SSCL was aware of being a “magnet” for cyber-attacks, sources said. A public warning about identity theft has been on the website of its parent company, Sopra Steria, for at least three years, according to an examination of the page’s history.
The hack was first internally detected in February, sources said, with concerns about potentially successful phishing attacks on the company dating back to December 2019.
SSCL and its parent company hold a total of £1.6bn in government contracts. These include a range of highly sensitive functions such as Home Office recruitment and online testing for officers, according to information from contracts gathered by the data company Tussell.
The Chinese embassy has said China was not responsible for the hack. A spokesperson said: “We urge the relevant parties in the UK to stop spreading false information, stop fabricating so-called China threat narratives, and stop their anti-China political farce.”