MoD investigating another contractor breach

Ransomware incident at Dodd Group exposed base details and staff’s personal information

The Ministry of Defence is investigating after a contractor with ties to the British military was breached by a ransomware gang.

The Dodd Group, a property maintenance firm based in Shropshire, works with the MoD to provide electrical and mechanical services to British military bases.

The Lynx ransomware group, a reincarnation of INC Ransomware, recently posted samples of data stolen from Dodd Group on its darkweb site. The group claims to have stolen 4TB of information.

The Mail on Sunday, which was first to report the dark web data, said it includes details on eight RAF and Royal Navy bases; personnel names and email addresses for MoD staff; and contractors’ names, car registrations and mobile numbers.

The trove also appears to include project documents, including lighting at various military bases and the installation of a new oil tank, apparently involving construction group Kier.

A Dodd spokesperson confirmed there had been a “ransomware incident whereby an unauthorised third-party gained temporary access to part of our internal systems.”

They added, “We took immediate steps to contain the incident, swiftly secure our systems and engaged a specialist IT forensic firm to investigate what happened.

“We are taking these claims extremely seriously and are working hard to validate this.”

The MoD said it was actively investigating the claims that defence data had been published on the dark web, but would not comment further.

It is not known whether Dodd Group paid any ransom, but the UK’s upcoming Cyber Security and Resilience Bill would make such a move illegal. The government is likely to introduce the bill next month.

The attack at Dodd Group follows two high-profile cyber incidents affecting the MoD.

In July this year a large data breach affecting Afghans resettled in the UK came to light when a judge lifted a gagging order from 2023.

And in May 2024 a cyber incident at another contractor – ironically responsible for cybersecurity monitoring – compromised data belonging to 270,000 MoD personnel.

If you’re a current or aspiring cybersecurity leader check out the Computing Security Leaders Summit on March 26th 2026. Packed with content including business continuity planning, bridging the cyber skills gap and cloud resilience, its promises to be full of insight and practical advice to take away. Register here for your free place.