The UK army's recruitment system has been offline for over a month after candidate data was found on the dark web.
Data for around 120 recruits was spotted as for sale on a rogue website, leading officials to suspect the system had been compromised, according to The Guardian.
The system, which is run in partnership with outsourcing firm Capita, has been offline since mid-March, almost coinciding with Russia's invasion of Ukraine, though it is not thought that it is the work of any Russian-related actors. However, the incident was serious enough that the Ministry of Defence (MoD) felt it needed to notify the Information Commissioner's Office (ICO).
"The Ministry of Defence made us aware of this incident," an ICO spokesperson said. "After making enquiries and carefully reviewing the information provided, we decided no further action was needed at this time."
An MoD investigation is still ongoing as it is unclear if the compromise is because of a hack or a simple case of an unauthorized party getting access to a screen grab or a printout of the data.
"Following the compromise of a small selection of recruit data, the army's online recruitment services were temporarily suspended pending an investigation," an Army spokesperson told the Guardian. "This investigation has now concluded allowing some functionality to be restored and applications to be processed."
RELATED RESOURCE
Recommendations for managing AI risks
Integrate your external AI tool findings into your broader security programs
While the internal Defence Recruitment System has been restored, the army's external online portal is still down and has been a cause of concern. Emergency systems have had to be used to handle candidate recruitment for the last five weeks.
Whatever the method or scale of the breach, it is another setback for the army and its partnership with Capita. The two have jointly handled the recruitment site since 2012, though it has been riddled with issues. In 2018, the National Audit Office blamed both the MoD and Capita for severe delays that contributed to multiple missed targets over six years.
-
Bigger salaries, more burnout: Is the CISO role in crisis?In-depth CISOs are more stressed than ever before – but why is this and what can be done?
-
Cheap cyber crime kits can be bought on the dark web for less than $25News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
ICO admits it's too slow dealing with complaints – so it's eying up automation to cut staff workloadsNews The UK's data protection authority has apologized for being slow to respond to data protection complaints, saying it's been overwhelmed by increased workloads.
-
“Limited resources” scupper ICO probe into EasyJet breachNews The decision to drop the probe has been described as “deeply concerning” by security practitioners
-
Surge in workplace monitoring prompts new ICO guidelines on employee privacyNews Detailed guidance on how to implement workplace monitoring could prevent data protection blunders
-
TikTok could be hit with £27m fine for failing to protect children's privacyNews Social media firm issued with a notice from the ICO for potential violations of UK data protection laws
-
What is AdTech and why is it at the heart of a regulation storm?In-depth The UK data regulator has come under heavy fire for consistently delaying much-needed action, privacy groups say
-
ICO crackdown on AI recruitment part of three-year vision to save businesses £100 millionNews ICO25 outlines a fresh approach that involves releasing learning materials, advice, and a new ICO-moderated discussion forum for businesses
-
Clearview AI fined £7.5m over improper use of UK dataNews Australian facial recognition firm collected 20 billion images from the internet without consent in order to build its database
-
UK data watchdog cut IT spending by £1.2 million during pandemicNews The ICO’s IT budget has been slashed by around 23% since 2019
