Parliament Hack: 90 Email Accounts?

Yes, the UK Parliament cyber-attack in 2017 compromised around 90 email accounts out of nearly 9,000 accounts in total. The attack targeted users with weak passwords, and while the majority of accounts were protected by multi-factor authentication, those without it were vulnerable. This article explains what happened, how the attack worked, and what it means for online security.

Background of the Attack

In June 2017, the UK Parliament’s computer network came under a sustained cyber-attack. The attack was first detected by the parliamentary IT team, who noticed unusual activity and immediately took steps to contain it. The investigation revealed that the attackers had carried out a “brute force” attack, systematically trying different password combinations on user accounts.

At the time, Parliament had around 9,000 accounts for MPs, their staff, and other parliamentary employees. The attack specifically targeted accounts that were not protected by two-factor authentication (2FA). While the majority of accounts had 2FA enabled, a smaller number did not, and it was these accounts that were compromised.

How the Attack Worked

The attackers used a technique known as a “credential stuffing” or “password spraying” attack. Instead of trying many passwords for one account (which would lock the account), they tried a small number of common passwords across many accounts. This approach is less likely to trigger lockout policies and can be very effective when users have weak passwords.

• Step 1: The attackers obtained a list of email addresses from public sources, such as the Parliament website.
• Step 2: They used automated tools to try a handful of common passwords (e.g., “password”, “123456”, “qwerty”) against each account.
• Step 3: Any account that accepted one of these passwords was compromised, allowing the attacker to read emails and access other services.

This method is effective because many people still use weak or reused passwords. The attack was not highly sophisticated, but it exploited a basic security weakness: lack of 2FA and poor password hygiene.

What Was Accessed

The attackers gained access to the email accounts of MPs, their staff, and parliamentary employees. The exact content of the emails accessed has not been fully disclosed, but it is likely that the attackers were looking for sensitive political information, personal data, or material that could be used for further attacks or influence.

Parliament took immediate action by remotely locking the affected accounts and forcing password resets. They also contacted the National Cyber Security Centre (NCSC) for assistance. The investigation was thorough, but the full extent of the data accessed may never be publicly known.

Response and Security Changes

In response to the attack, Parliament implemented several security improvements:

• Forced password resets for all users.
• Enabled two-factor authentication for all accounts, not just a subset.
• Introduced mandatory cyber security training for all staff and MPs.
• Strengthened network monitoring and threat detection systems.

These changes were part of a broader effort to improve the security of parliamentary systems. The attack served as a wake-up call for many organizations about the importance of basic security measures like 2FA and strong passwords.

Common Misconceptions

One common misconception is that the attack was highly sophisticated or state-sponsored. While the identity of the attackers was not officially confirmed, the technique used was relatively simple. This highlights that even basic attacks can succeed if organizations do not enforce basic security practices.

Another misconception is that the 90 compromised accounts were all MPs. In reality, the accounts belonged to a mix of MPs, their staff, and parliamentary employees. The exact breakdown has not been published, but it is known that the attack affected a small percentage of the total accounts.

Lessons for Individuals and Organizations

This incident offers several important lessons:

• Use strong, unique passwords: Avoid common passwords and do not reuse passwords across different services.
• Enable two-factor authentication: This adds an extra layer of security that can block most automated attacks.
• Be aware of phishing: Attackers often use information from compromised accounts to craft convincing phishing emails.
• Regularly update and patch systems: Keeping software up to date reduces vulnerabilities.

For organizations, the attack underscores the need for regular security audits, mandatory training, and robust monitoring. The cost of a breach can be far higher than the cost of prevention.

Frequently Asked Questions

How many accounts were actually compromised?

Around 90 email accounts were compromised out of approximately 9,000 total accounts. This represents about 1% of the accounts, but the impact was significant due to the sensitive nature of the data.

Was any sensitive information leaked?

There is no public evidence that the attackers released any of the accessed data. However, the investigation could not rule out that data was viewed. Parliament took steps to contain the breach and monitor for any misuse.

Why weren’t all accounts protected by 2FA?

At the time, 2FA was not mandatory for all accounts. It was available but not universally enforced. The attack prompted Parliament to make 2FA mandatory for all users, closing the gap that the attackers exploited.

How can I protect my own email account from a similar attack?

Use a unique, strong password for your email, enable two-factor authentication, and be cautious about clicking links in unsolicited emails. Also, consider using a password manager to generate and store complex passwords.

Did the attack affect the general public?

The attack was targeted at parliamentary accounts and did not directly affect the general public. However, it highlighted the importance of cyber security for all organizations and individuals.

Related

• How to Turn Off Motion Photo on Samsung
• Django vs FastAPI: How to Choose
• Ban or Unban a Player on Core Keeper Server