BBC report adds to the original report by The Stack [0] which says the clues came to light in a urgent contract tender document in January (2022) [1] which says:

    Provision of Business Analyst and Technical Architect support to analyse an Authority cyber security incident. Due to the nature of the cyber security incident, the specific Deliverables cannot be disclosed.

[0] Foreign Office hacked in “serious cyber security incident”https://thestack.technology/foreign-office-hacked-fcdo-cyber...

[1] "Provision of urgent business support" https://www.find-tender.service.gov.uk/Notice/003220-2022?or...