...
By Brendan Cole
Senior Reporter
0
Share
Newsweek is a Trust Project member
See more of our trusted coverage when you search.Prefer Newsweek on Googleto see more of our trusted coverage when you search.
Russian hackers stole sensitive documents about military bases, including one where U.S. aircraft are stationed, it has been reported.
The U.K.’s Ministry of Defense (UK MOD) told Newsweek it was looking into the claims reported by the Mail on Sunday newspaper that the files with sensitive details about the Royal Air Force (RAF) and Royal Navy bases, as well as their personnel, had been published on the dark web.
Both maintenance and construction contractor Dodd Group, which confirmed the breach, and the MOD said an investigation was underway, but neither have revealed further details of the reported breach.
Read More on News
The UK MOD told Newsweek it was "actively investigating" the claims, while the Dodd Group said it had "experienced a ransomware incident."
David Shrier, a professor of practice, AI & Innovation at Imperial Business School in London, told Newsweek on Monday that what has been reported suggested human failure, where someone opened an email which they shouldn’t have, or possibly connected a device that was improperly secured.
Newsweek reached out to the Pentagon for comment via email.
...
Why It Matters
The reported breach included details on the RAF Lakenheath site in Suffolk, where U.S. Air Force's F-35 and F15 jets are based, adding to speculation about aggressive Russian hybrid warfare tactics toward NATO members.
What To Know
The Mail on Sunday reported that sensitive military documents were stolen by Russian hackers and released on the dark web, which is part of the internet that can only be accessed through particular software.
The newspapers said that the files contained details of eight RAF and Royal Navy bases as well as MOD staff names and emails.
The paper said that among the sites targeted was RAF Lakenheath in Suffolk, which hosts U.S. fighter jets, RAF Portreath, which forms part of NATO's defense network, and RAF Predannack, home to the U.K's National Drone Hub.
Approximately 1,000 documents included visitor forms for RAF Portreath with contractors' and MOD personnel's data and email guidance and security instructions which could be exploited for phishing attacks, the newspaper said.
A Dodd Group spokesperson told Newsweek there had been a ransomware incident in which an unauthorized third-party gained temporary access to part of its internal systems and that "immediate steps" were taken to contain the incident and secure the systems, without providing further details.
Shrier told Newsweek it was notable the breach appeared to have centered on a maintenance subcontractor who referred to a ransomware attack rather than a "direct frontal assault."
“Corporations have the same issue, when you are engaging in cyber security, you need to not only evaluate your partners, but also everyone they subcontract to,” Shrier said.
The MOD said in a statement it was investigating the claims but would not comment further so as to safeguard sensitive operational information.
The incident follows other high-profile data breaches at the MOD, which include personal details about thousands of Afghans brought to safety in the U.K. being exposed after an MOD subcontractor suffered a data breach. In 2024, the personal information of an unknown number of serving U.K. military personnel was also accessed in a significant data breach.
In August, Russia was accused of involvement in the hack of a computer system that manages federal court documents, including highly sensitive records of sources and people charged with national security crimes.
What People Are Saying
The U.K. Ministry of Defence in a statement to Newsweek: “We are actively investigating claims that information relating to the MOD has been published on the Dark Web. To safeguard sensitive operational information, we will not comment any further on the details.”
A Dodd Group statement to Newsweek: "We took immediate steps to contain the incident, swiftly secure our systems and engaged a specialist IT forensic firm to investigate what happened.
"While our forensic investigation is ongoing, we are aware of claims that data taken from our systems have been published online. We are taking these claims extremely seriously and are working hard to validate this."
David Shrier, professor of practice, AI & Innovation at Imperial Business School, London, told Newsweek: "The fact pattern tends to suggest that at some point there was a human failure, where someone opened an email which they shouldn’t have, or possibly connected a device that was improperly secured."
What Happens Next
The statements from the Dodd Group and the U.K. MOD point to an investigation but revealed no further details of the reported breach, and Russia is likely to face further accusations of cyber activities aimed at destabilizing Europe.
Update 10/20/25, 10:33 a.m. ET: This article was updated with comment from David Shrier and statements from the U.K. Ministry of Defense and the Dodd Group.
View 0 Comments
Submit Correction
View Editorial & AI Guidelines