Scottish Parliament hit with 'brute force' cyber attack

The Scottish parliament has been hit by a "brute force" cyber attack according to an internal memo, an attack that was almost identical to the one that hit Westminster's email system in June.

Holyrood officials were warned on Tuesday that hackers had repeatedly tried to break past authentication screens to internal accounts by entering random passwords, although there has been no evidence that the attack succeeded.

An internal memo, issued by Holyrood chief executive Sir Paul Grice and seen by the Guardian, warned that the attack may have resulted in MPs and staff being locked out of their email accounts.

"This attack appears to be targeting parliamentary IT accounts in a similar way to that which affected the Westminster parliament in June. Symptoms of the attack include account lockouts or failed log-ins," wrote Grice.

He added that the parliament's "robust cyber security measures" were able to identify the attack early, and that additional security safeguards were deployed before accounts were compromised.

However, he also said that a sweep of email accounts found that many officials were using passwords that were too weak and easily bypassed.

Following the cyber attack against Westminster email accounts in June, in which only 1% of accounts were reportedly accessed, it is likely Holyrood was on high alert in the event of a similar attack.

Jon Geater, CTO of Thales E-security, said that public bodies need to be treating cyber security as something more than a box-ticking exercise. "This latest brazen attempt to access sensitive information shows that no holds are barred in this fight: even guessing of information is on the table, and, if it fails, it will still lock out users and cause havoc."

"With such crippling effects to a government's bottom line and public reputation, the risk of falling victim to a severe cyber attack is without doubt depriving today's business leaders of much-needed sleep," added Geater. "A watertight data security and encryption strategy to ensure data privacy is now an indispensable element of an organisation's wider cyber security strategy."

Early investigation reports suggested that Russia could have been behind the attack on the UK Parliament, and although it is currently unclear who was responsible for yesterday's attempted hack, it deployed the exact same brute force methods to bypass weak passwords.

Image: Bigstock