17 Accepted

MoD failed to notify PAC about data breach after 18-month delay and obtaining super-injunction.

Conclusion
The Department first became aware of the data breach on 14 August 2023, 18 months after it occurred, when personal details of 10 individuals from the dataset were posted online on Facebook.40 Following its discovery of the data breach, on 25 August 2023 the MoD decided to apply to the High Court for an injunction to prevent the data loss becoming public. Although the MoD did not originally apply for a ‘super-injunction’, on 1 September 2023 the High Court granted this form of legal ruling, which prevented disclosure of both the data breach and the existence of the injunction itself.41 The Department told us that in the two-week period between it becoming aware of the breach and the super-injunction being put in place, it was learning about the scope of the breach and the likely consequences. It was not at the forefront of officials’ minds that it was appropriate to notify the Public Accounts Committee (PAC).42
Government Response Summary
The government agrees to work with the Committee to ensure timely information sharing, committing to new guidance from the Treasury Officer of Accounts by Spring 2026 on super-injunctions and C&AG communication, and a Dear Accounting Officer letter to be incorporated into Managing Public Money.
Government Response
Accepted
HM Government Accepted
4.1 The government agrees with the Committee’s recommendation. Target implementation date: Spring 2026 4.2 The department will continue to work with the Committee to ensure they have sufficient and timely information to enable them to undertake their roles in the context of any similar situations in the future. The department is keeping under review how this is done in the most extreme cases where secrecy poses a challenge to the normal processes. This will be covered by the new guidance issued by the Treasury Officer of Accounts on how to act in the event of a super-injunction. 4.3 The government agrees with the Committee’s recommendation. Target implementation date: Spring 2026 4.4 The Treasury will issue a Dear Accounting Officer letter to provide guidance on this issue. This will include guidance on the principles and practicalities of sharing information with the Comptroller and Auditor General (C&AG) in the event of a super-injunction, with particular consideration of the statutory duty to give assistance, information and explanation to the C&AG to enable them to meet their statutory duty to examine government department’s accounts. The guidance will then be incorporated into the next update of Managing Public Money.
Addressee Bodies
HM Treasury
Timeline
Recommendation age 0.7 yr
Report published 14 Nov 2025