UK MoD contractor ransomware breach leaks data from RAF and US bases

British defence officials are investigating a ransomware attack on a Ministry of Defence contractor that cybercriminals say yielded hundreds of sensitive military files on eight Royal Air Force and Royal Navy sites, including two large bases used by the United States, officials and the contractor said. The breach of Dodd Group’s systems was first detected on 23 September and the attackers have posted portions of the stolen material on the dark web while threatening further releases.

Investigators believe the intrusion occurred through the contractor’s network, allowing the attackers to bypass military defences that would not normally be directly accessible. The criminal group claims to have taken roughly 4 terabytes of data and has begun publishing the material in staged releases. The files reportedly include visitor logs, personnel names and email addresses, phone numbers, vehicle registrations, internal security guidance and construction records tied to work at multiple bases.

Among the sites named in the leaked material are RAF Lakenheath and RAF Mildenhall, the two largest U.S. bases in the United Kingdom and home to U.S. Air Force squadrons and supporting personnel. Other...