Northern Ireland Parliament

Summary

A cyber-attack targeted the email service of the Northern Ireland Parliament, involving external attempts to access assembly mailboxes through repeated password attempts. Several accounts were compromised and subsequently disabled by IT services, prompting staff and political parties to be alerted. Affected personnel were instructed to change passwords immediately and remain vigilant, while the organization's IT team collaborated with Microsoft and the National Cyber Security Centre to monitor and address the incident.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On March 27, 2018, Stormont, the Northern Ireland Parliament, identified a cyber attack targeting its email service. The attack originated from an external source attempting unauthorized access to assembly mailboxes through repeated password attempts, indicating a brute-force method. Stormont’s IT services detected the intrusion and confirmed that multiple accounts had been compromised. These breached accounts were promptly disabled to prevent further unauthorized access. The parliament issued an internal warning to all staff, including representatives from political parties, advising them of the security incident. In an email circulated to assembly personnel, IT officials described the attack’s mechanics and emphasized the external nature of the threat. Staff were instructed to change their passwords immediately and maintain heightened vigilance regarding suspicious account activity. The incident disrupted normal email operations, though the full scope of compromised data or systems beyond the email service was not detailed in available reports.

Stormont’s head of IT convened a meeting with staff on the morning of March 27 to address the breach and reinforce security protocols. The parliament’s IT team collaborated with Microsoft and the UK’s National Cyber Security Centre (NCSC) to monitor the situation and mitigate risks. This partnership focused on identifying attack patterns and securing vulnerable accounts. No public evidence suggested data exfiltration or secondary attacks beyond the initial credential-based intrusion. The incident underscored vulnerabilities in parliamentary email systems, though specific technical weaknesses or attacker identities remained unconfirmed. Stormont’s response prioritized containment through account lockdowns, credential resets, and external coordination, with no further operational disruptions reported following these actions.

Sources

Sources available to members: 1 source.