Scottish Parliament hit with 'brute force' cyber attack

The attack is thought to mirror the hack on Westminster in June

The Scottish parliament has been hit by a "brute force" cyber attack according to an internal memo, an attack that was almost identical to the one that hit Westminster's email system in June.

Holyrood officials were warned on Tuesday that hackers had repeatedly tried to break past authentication screens to internal accounts by entering random passwords, although there has been no evidence that the attack succeeded.

An internal memo, issued by Holyrood chief executive Sir Paul Grice and seen by the Guardian, warned that the attack may have resulted in MPs and staff being locked out of their email accounts.

"This attack appears to be targeting parliamentary IT accounts in a similar way to that which affected the Westminster parliament in June. Symptoms of the attack include account lockouts or failed log-ins," wrote Grice.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

He added that the parliament's "robust cyber security measures" were able to identify the attack early, and that additional security safeguards were deployed before accounts were compromised.

However, he also said that a sweep of email accounts found that many officials were using passwords that were too weak and easily bypassed.

Following the cyber attack against Westminster email accounts in June, in which only 1% of accounts were reportedly accessed, it is likely Holyrood was on high alert in the event of a similar attack.

Jon Geater, CTO of Thales E-security, said that public bodies need to be treating cyber security as something more than a box-ticking exercise. "This latest brazen attempt to access sensitive information shows that no holds are barred in this fight: even guessing of information is on the table, and, if it fails, it will still lock out users and cause havoc."

"With such crippling effects to a government's bottom line and public reputation, the risk of falling victim to a severe cyber attack is without doubt depriving today's business leaders of much-needed sleep," added Geater. "A watertight data security and encryption strategy to ensure data privacy is now an indispensable element of an organisation's wider cyber security strategy."

Early investigation reports suggested that Russia could have been behind the attack on the UK Parliament, and although it is currently unclear who was responsible for yesterday's attempted hack, it deployed the exact same brute force methods to bypass weak passwords. 

Advertisement - Article continues below

Image: Bigstock

Featured Resources

The IT Pro guide to Windows 10 migration

Everything you need to know for a successful transition

Download now

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Software-defined storage for dummies

Control storage costs, eliminate storage bottlenecks and solve storage management challenges

Download now

6 best practices for escaping ransomware

A complete guide to tackling ransomware attacks

Download now
Advertisement

Most Popular

Visit/operating-systems/microsoft-windows/354297/this-exploit-could-give-users-free-windows-7-updates
Microsoft Windows

This exploit could give users free Windows 7 updates beyond 2020

9 Dec 2019
Visit/security/vulnerability/354309/patch-issued-for-critical-windows-bug
vulnerability

Patch issued for critical Windows bug

11 Dec 2019
Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019
Visit/data-insights/big-data/354311/google-reveals-uks-most-searched-for-terms-in-2019
big data

Google reveals UK’s most searched for terms in 2019

11 Dec 2019