Cyber Incident Victim: Parliament of the United Kingdom
Date:
Jan 2017
Location:
United Kingdom
Summary
The Parliament of the United Kingdom experienced a cyber attack involving phishing attempts targeting MPs and political party staff through personal email accounts. The incident, suspected to be politically motivated, aimed to steal login credentials via fraudulent password reset requests but resulted in no data loss, affecting fewer than ten individuals. Security officials warned that similar attacks could persist against parliamentary email addresses, prospective candidates, and party personnel, advising vigilance against suspicious account activity.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In early 2017, Members of Parliament and political party staff in the United Kingdom were targeted in a cyber attack involving phishing attempts against their personal email accounts. Security officials disclosed that attackers sent scam emails designed to trick individuals into revealing passwords and account details, with fewer than 10 MPs directly affected. The National Cyber Security Centre (NCSC), an arm of GCHQ, confirmed the campaign specifically targeted individuals who were MPs before the dissolution of parliament and other political party staff. The attacks focused exclusively on personal email accounts rather than official parliamentary systems, with no successful data breaches or losses reported. Security analysts noted the timing coincided with heightened concerns about foreign interference in democratic processes following the 2016 US election incidents, though officials did not attribute responsibility to any specific actor.
The NCSC issued warnings to political staff and parliamentary candidates following the discovery, advising them to scrutinize emails dating back to January 2017 for unexpected password reset requests targeting social media and technology platforms like Apple, Google, Microsoft, Facebook, and Twitter. Security services anticipated continued phishing attempts against parliamentary email addresses, prospective candidates, and party personnel. While the immediate operational impact was limited due to the attackers' failure to compromise accounts, the incident prompted security officials to monitor for similar activities resembling election interference patterns. The NCSC maintained its standard protocol of not publicly speculating on potential perpetrators, noting that criminal groups, activists, terrorists, and nation-states all engage in such operations. No further successful compromises were reported following the initial detection and advisory.