20 Accepted

C&AG discovered data breach publicly in 2025, while audit director was secretly briefed but silenced.

Conclusion
The C&AG told us that the first he knew about the data breach was when it became publicly known in July 2025. His audit director had been briefed at the time of auditing the 2023–24 accounts, that there was a secret matter that could not be shared, and it meant there was a data breach that had not been included in the governance statement in the accounts. There was no briefing of the NAO by the Department about the operational consequences of this, the number of people affected, or the likely cost.52 The audit director was told that they could not tell anybody at the NAO about the detail that they had been briefed with.53 46 Q 32 47 Q 36 48 C&AG’s Report, para 18 49 Q 32 50 Q 40 51 Letter from Ministry of Defence, 7 October 2025 52 Q 33 53 Q 35 14
Government Response Summary
The government agrees to work with the Committee to ensure timely information sharing, committing to new guidance from the Treasury Officer of Accounts by Spring 2026 on super-injunctions and C&AG communication, and a Dear Accounting Officer letter to be incorporated into Managing Public Money.
Government Response
Accepted
HM Government Accepted
4.1 The government agrees with the Committee’s recommendation. Target implementation date: Spring 2026 4.2 The department will continue to work with the Committee to ensure they have sufficient and timely information to enable them to undertake their roles in the context of any similar situations in the future. The department is keeping under review how this is done in the most extreme cases where secrecy poses a challenge to the normal processes. This will be covered by the new guidance issued by the Treasury Officer of Accounts on how to act in the event of a super-injunction. 4.3 The government agrees with the Committee’s recommendation. Target implementation date: Spring 2026 4.4 The Treasury will issue a Dear Accounting Officer letter to provide guidance on this issue. This will include guidance on the principles and practicalities of sharing information with the Comptroller and Auditor General (C&AG) in the event of a super-injunction, with particular consideration of the statutory duty to give assistance, information and explanation to the C&AG to enable them to meet their statutory duty to examine government department’s accounts. The guidance will then be incorporated into the next update of Managing Public Money.
Addressee Bodies
HM Treasury
Timeline
Recommendation age 0.7 yr
Report published 14 Nov 2025