Russian hackers leak documents linked to eight UK military bases as MoD launches probe

Cyber & Information WarfareCyber AttacksData theft / leaks

Aggressor

Summary

Russian hacker group Lynx leaked internal documents linked to eight UK military bases in a cyberattack on defense contractors; the UK MoD is investigating.

In mid-October 2025, the Russian hacker group Lynx successfully breached the IT systems of UK defense contractor Dodd Group and another contractor, Kier. They stole sensitive internal documents related to eight UK military bases containing personal employee data and operational cybersecurity protocols. Among the leaked materials were schematics of RAF bases storing nuclear weapons and hosting U.S. F-35 fighter jets, details about the UK Ministry of Defence's primary drone base, an ultra-secret radar installation, and naval facility information. The hackers demanded a ransom, threatening to publish the data, some of which has already appeared on the dark web. The UK Ministry of Defence has confirmed the breach and is actively probing the incident. This breach is part of a pattern of data compromises at the UK MoD, including previous hacks exposing personal data of evacuated Afghans and British military personnel. The involved contractors have engaged forensic experts to contain and investigate the ransomware incident.

Classification

Confidence: High

The article explicitly details a Russian hacker group, Lynx, conducting a ransomware cyberattack on UK defense contractors linked to military bases, with leaked sensitive military documents and confirmed MoD investigation, demonstrating aggressor hybrid activity.

Source URL

https://theins.press/en/news/286028

Open source

Provenance

Publisher: extension
Submitted: Apr 28, 2026, 19:29 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Oct 18, 2025, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "72cb435a-72ba-4c40-bf7e-a4ed89706779",
  "url": "https://theins.press/en/news/286028",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Data theft / leaks",
  "country": "United Kingdom",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "Russian hackers",
    "Lynx hacker group",
    "UK Ministry of Defence",
    "cyberattacks",
    "Ransomware",
    "Military bases",
    "Data leak",
    "Nuclear weapons storage",
    "F-35 jets",
    "offensive cyber operations"
  ],
  "nodes": [
    "Node 1: Borders"
  ],
  "countries": [
    "United Kingdom"
  ],
  "where_text": "Cyberspace",
  "headline": "Russian hackers leak documents linked to eight UK military bases as MoD launches probe",
  "description": "On or before October 18, 2025, Russian hacker group Lynx infiltrated the systems of UK defense contractor Dodd Group and another contractor Kier, stealing internal documents linked to eight British military bases, including schematics of RAF bases housing nuclear weapons and U.S. F-35 jets, data on the UK MoD's main drone base, an ultra-secret radar station, and naval facilities. The hackers demanded ransom and published some confidential materials on the dark web. The UK Ministry of Defence confirmed the breach and is actively investigating. This incident follows previous major data breaches at the UK MoD involving personal data exposures.",
  "summary_short": "Russian hacker group Lynx leaked internal documents linked to eight UK military bases in a cyberattack on defense contractors; the UK MoD is investigating.",
  "summary_extended": "In mid-October 2025, the Russian hacker group Lynx successfully breached the IT systems of UK defense contractor Dodd Group and another contractor, Kier. They stole sensitive internal documents related to eight UK military bases containing personal employee data and operational cybersecurity protocols. Among the leaked materials were schematics of RAF bases storing nuclear weapons and hosting U.S. F-35 fighter jets, details about the UK Ministry of Defence's primary drone base, an ultra-secret radar installation, and naval facility information. The hackers demanded a ransom, threatening to publish the data, some of which has already appeared on the dark web. The UK Ministry of Defence has confirmed the breach and is actively probing the incident. This breach is part of a pattern of data compromises at the UK MoD, including previous hacks exposing personal data of evacuated Afghans and British military personnel. The involved contractors have engaged forensic experts to contain and investigate the ransomware incident.",
  "actor_primary": "Lynx",
  "target_primary": null,
  "location_text": "United Kingdom",
  "location_region": null,
  "location_coordinates_lat": 55.378051,
  "location_coordinates_lon": -3.435973,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article explicitly details a Russian hacker group, Lynx, conducting a ransomware cyberattack on UK defense contractors linked to military bases, with leaked sensitive military documents and confirmed MoD investigation, demonstrating aggressor hybrid activity.",
  "event_time_utc": "2025-10-18T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-04-28T19:29:00.192Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "within_24h",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighIndependence confirmedTime: Same dayLocation: Regional

Source reliability

Info credibility

Event time

Oct 18, 2025, 00:00 UTC

Event time confidence

pm24h

Location

United Kingdom

Primary actor

Lynx

Country

United Kingdom

Countries

United Kingdom

Tags

Russian hackers, Lynx hacker group, UK Ministry of Defence, cyberattacks, Ransomware, Military bases, Data leak, Nuclear weapons storage, F-35 jets, offensive cyber operations

Nodes

Node 1: Borders

Loading signal...

{ "id": "72cb435a-72ba-4c40-bf7e-a4ed89706779", "url": "https://theins.press/en/news/286028", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Data theft / leaks", "country": "United Kingdom", "source_reliability": "B", "info_credibility": "3", "tags": [ "Russian hackers", "Lynx hacker group", "UK Ministry of Defence", "cyberattacks", "Ransomware", "Military bases", "Data leak", "Nuclear weapons storage", "F-35 jets", "offensive cyber operations" ], "nodes": [ "Node 1: Borders" ], "countries": [ "United Kingdom" ], "where_text": "Cyberspace", "headline": "Russian hackers leak documents linked to eight UK military bases as MoD launches probe", "description": "On or before October 18, 2025, Russian hacker group Lynx infiltrated the systems of UK defense contractor Dodd Group and another contractor Kier, stealing internal documents linked to eight British military bases, including schematics of RAF bases housing nuclear weapons and U.S. F-35 jets, data on the UK MoD's main drone base, an ultra-secret radar station, and naval facilities. The hackers demanded ransom and published some confidential materials on the dark web. The UK Ministry of Defence confirmed the breach and is actively investigating. This incident follows previous major data breaches at the UK MoD involving personal data exposures.", "summary_short": "Russian hacker group Lynx leaked internal documents linked to eight UK military bases in a cyberattack on defense contractors; the UK MoD is investigating.", "summary_extended": "In mid-October 2025, the Russian hacker group Lynx successfully breached the IT systems of UK defense contractor Dodd Group and another contractor, Kier. They stole sensitive internal documents related to eight UK military bases containing personal employee data and operational cybersecurity protocols. Among the leaked materials were schematics of RAF bases storing nuclear weapons and hosting U.S. F-35 fighter jets, details about the UK Ministry of Defence's primary drone base, an ultra-secret radar installation, and naval facility information. The hackers demanded a ransom, threatening to publish the data, some of which has already appeared on the dark web. The UK Ministry of Defence has confirmed the breach and is actively probing the incident. This breach is part of a pattern of data compromises at the UK MoD, including previous hacks exposing personal data of evacuated Afghans and British military personnel. The involved contractors have engaged forensic experts to contain and investigate the ransomware incident.", "actor_primary": "Lynx", "target_primary": null, "location_text": "United Kingdom", "location_region": null, "location_coordinates_lat": 55.378051, "location_coordinates_lon": -3.435973, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The article explicitly details a Russian hacker group, Lynx, conducting a ransomware cyberattack on UK defense contractors linked to military bases, with leaked sensitive military documents and confirmed MoD investigation, demonstrating aggressor hybrid activity.", "event_time_utc": "2025-10-18T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-04-28T19:29:00.192Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "within_24h", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "independent_sources" }