Cyber Incident Victim: Mike Freer
Date:
Feb 2019
Location:
United Kingdom
Summary
Parliamentary authorities investigated a malicious phishing attempt targeting MPs' email and phone contact lists, urging recipients to provide overseas contact details or download a fraudulent messaging app. The attack, which accessed private contacts to propagate further messages, prompted warnings from deputy chief whip Christopher Pincher and involved government whip Mike Freer's compromised personal phone number being used to add dozens of MPs—including cabinet ministers—to an unauthorized WhatsApp group. Freer publicly confirmed the breach, advising contacts to disregard suspicious emails falsely requesting international connections for government payments, while parliamentary officials declined to disclose the scope of compromised data or potential perpetrators. This incident followed a prior cyberattack on parliamentary accounts attributed to foreign actors.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On February 4, 2019, UK parliamentary authorities initiated an investigation into a malicious cyber incident targeting Members of Parliament. Attackers attempted to compromise MPs' email and phone contact lists through phishing messages disguised as official requests. Deputy Chief Whip Christopher Pincher alerted colleagues via email to ignore unsolicited communications asking them to "provide overseas contact details" or download a "secure message app," identifying the activity as a malicious hack designed to harvest private contact information. The Parliamentary Digital Service was notified to address the security breach. Concerns escalated when government whip Mike Freer's personal mobile number was implicated in the attack, with his compromised device automatically adding dozens of MPs—including cabinet ministers—to a WhatsApp group titled "Hack warning 1" that afternoon.
The incident caused immediate disruption as startled MPs rapidly exited the unauthorized WhatsApp group, prompting the removal of Freer's number from the platform. Freer confirmed his device had been hacked via a Facebook post, advising contacts to disregard any emails falsely attributed to him requesting overseas contacts for "government payment" purposes. At least one recipient received a fraudulent email purportedly from Freer specifically soliciting contacts in China. Parliamentary authorities declined public comment despite confirming an active investigation, mirroring their response to the 2017 Iran-linked cyberattack that compromised approximately 90 parliamentary accounts. The scope of compromised contacts and responsible threat actors remained undetermined at the time of reporting, with no further operational details disclosed about containment measures or forensic findings.