But by the time Shapps made his statement to Parliament hours later, China was no longer being mentioned by name. Instead, Shapps focused on the third-party company that managed the payroll system. “This was operated by a contractor and there is evidence of potential failings by them which may have made it easier for the malign actor to gain entry,” Shapps said.
No confirmed connection to a nation-state
Although Shapps didn’t explicitly blame the contractor, the government has started a review of the company and its operations, he said. “Although we can see a malign actor was involved, we have yet to make the connection to a state. Although we can’t rule out that that might be the conclusion, we have no evidence to conclude that way yet,” he said.
The incident reveals a knot of issues, starting with the political problem of attribution. The government clearly believes that China was behind the hack but doesn’t want to say that publicly to avoid getting into a diplomatic slanging match.
