MoD breach: Data goes missing from "secure location"

IT contractor EDS has lost a hard drive containing Ministry of Defence data.

According to press reports, the drive contained sensitive information on approximately 100,000 armed-forces personnel, plus 600,000 potential recruits.

The Ministry of Defence confirmed to silicon.com sister site ZDNet.co.uk on Friday that a hard disk had been lost by EDS, but would not confirm that the removable hard disk contained personal information.

"On Wednesday 8 October we were informed by our contractor EDS that they were unable to account for a portable hard drive used in connection with the administration of armed-forces personnel data," the MoD said in a statement. "This came to light during a priority audit EDS are conducting to comply with the Cabinet Office data-handling review. The MoD police are investigating with EDS."

EDS told ZDNet.co.uk the disk was being held in a secure location in premises in Hampshire when it went missing but was unable to say exactly what data was on the drive.

EDS said in a statement Friday: "We have been unable to account for a removable hard drive that was held in a secure location at our facility in Hook. We are working with [the MoD] to investigate this, including to establish what data may have been on the hard drive. There is no evidence that security at the site has been breached."

ZDNet.co.uk understands that as the disk was stored in a secure area, under standard EDS procedures the disk would not have been encrypted. As site security has not been breached, it is thought that the probable cause of the loss was not targeted theft. However, insider petty theft and a chance that the disk could be being used elsewhere on the premises are also possibilities.

In January, the MoD admitted it had lost three unencrypted laptops containing details of 600,000 defence personnel. The MoD also revealed in July that 658 laptops had been stolen from it in four years.

Original article: EDS loses unencrypted armed-forces data from ZDNet UK