Scottish Parliament hit with 'brute force' cyber attack

The attack is thought to mirror the hack on Westminster in June

The Scottish parliament has been hit by a "brute force" cyber attack according to an internal memo, an attack that was almost identical to the one that hit Westminster's email system in June.

Holyrood officials were warned on Tuesday that hackers had repeatedly tried to break past authentication screens to internal accounts by entering random passwords, although there has been no evidence that the attack succeeded.

Advertisement - Article continues below

An internal memo, issued by Holyrood chief executive Sir Paul Grice and seen by the Guardian, warned that the attack may have resulted in MPs and staff being locked out of their email accounts.

"This attack appears to be targeting parliamentary IT accounts in a similar way to that which affected the Westminster parliament in June. Symptoms of the attack include account lockouts or failed log-ins," wrote Grice.

He added that the parliament's "robust cyber security measures" were able to identify the attack early, and that additional security safeguards were deployed before accounts were compromised.

However, he also said that a sweep of email accounts found that many officials were using passwords that were too weak and easily bypassed.

Following the cyber attack against Westminster email accounts in June, in which only 1% of accounts were reportedly accessed, it is likely Holyrood was on high alert in the event of a similar attack.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

Jon Geater, CTO of Thales E-security, said that public bodies need to be treating cyber security as something more than a box-ticking exercise. "This latest brazen attempt to access sensitive information shows that no holds are barred in this fight: even guessing of information is on the table, and, if it fails, it will still lock out users and cause havoc."

"With such crippling effects to a government's bottom line and public reputation, the risk of falling victim to a severe cyber attack is without doubt depriving today's business leaders of much-needed sleep," added Geater. "A watertight data security and encryption strategy to ensure data privacy is now an indispensable element of an organisation's wider cyber security strategy."

Early investigation reports suggested that Russia could have been behind the attack on the UK Parliament, and although it is currently unclear who was responsible for yesterday's attempted hack, it deployed the exact same brute force methods to bypass weak passwords. 

Image: Bigstock

Advertisement

Recommended

Visit/security/cyber-security/355210/cyber-criminals-torn-over-how-to-adapt-to-post-coronavirus-threat
cyber security

Hackers torn over how to adapt their tactics to the coronavirus pandemic

3 Apr 2020

Most Popular

Visit/security/privacy/355211/google-releases-location-data-to-showcase-effectiveness-of-coronavirus
privacy

Google releases location data to show effectiveness of coronavirus lockdowns

3 Apr 2020
Visit/data-insights/data-management/355170/oracle-cloud-courses-are-free-during-coronavirus-lockdown
data management

Oracle cloud courses are free during coronavirus lockdown

31 Mar 2020
Visit/software/355113/companies-offering-free-software-to-fight-covid-19
Software

These are the companies offering free software during the coronavirus crisis

2 Apr 2020