The lawyers added that even explaining what harm had come from the impact of previous incidents was exempt from release because it could harm the commercial interests of contractors.
Cyber attacks reported to the MoD and the UK's National Cyber Security Centre are not referred to other regulators as a matter of course. Publicly listed companies are expected to inform the Financial Conduct Authority about any material incidents, including cyber attacks, whether personal data is lost or not.
There are many possibilities that such an attack may resemble, but among the most significant was a data breach at the US Office of Personnel Management , in which the records of more than 21 million federal government staffAmong the documents stolen from the OPM were copies of a document known as Standard Form 86, a detailed 127-page questionnaire filled out by staff seeking security clearance, detailing how they might be vulnerable to hostile spies.