Anatomy of a Breach

Anatomy of a Breach: UK Labour Party — DDoS Attacks During a General Election Campaign

> series: anatomy_of_a_breach —— part: 131 —— target: uk_labour_party —— method: ddos —— context: general_election_campaign<span class="cursor-blink">_</span>_

Hedgehog Security 30 November 2019 12 min read

A DDoS attack on a political party. During a general election. In the UK.

On 11 November 2019, the UK Labour Party confirmed that it had been the target of a large-scale DDoS attack on its digital platforms. A second, smaller attack followed the next day. The attacks, which occurred during the 2019 UK general election campaign, targeted Labour's website and online campaign tools. Cloudflare, which provided DDoS mitigation for the party, confirmed the attacks were 'large-scale' but were successfully mitigated without significant service disruption.

While no data was stolen and the operational impact was limited, the attacks were significant for their context: a major UK political party was targeted during a general election campaign — bringing the cyber threats to democratic processes documented throughout this series (DNC hack 2016, Philippines COMELEC 2016, UK Parliament email attack 2017) directly into the UK's electoral cycle. The source of the attacks was not publicly attributed, and no group claimed responsibility. The NCSC subsequently strengthened its guidance to political parties on cyber resilience.


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Cyber attacks on elections are now part of the UK threat landscape.

The Labour Party DDoS attacks confirmed that UK democratic processes face the same cyber threats that have affected elections worldwide. From the Russian hack of the DNC (2016) to the Philippines voter data leak (2016) to the UK Parliament brute-force attack (2017), the pattern is clear: democratic institutions and political organisations are cyber targets — whether for disruption, data theft, or influence operations.

Election-Time Targeting
The timing — during an active general election campaign — maximised the potential disruption. Political parties depend on digital platforms for fundraising, volunteer coordination, voter outreach, and messaging. Disrupting these platforms during a campaign creates asymmetric impact. For <a href="/blog/sector-under-the-microscope-local-government">UK local government</a> bodies responsible for election administration, DDoS resilience is a democratic obligation.
DDoS Mitigation Worked
Cloudflare's DDoS mitigation successfully absorbed the attacks without significant disruption — demonstrating that prepared organisations with appropriate DDoS protection can weather even large-scale attacks. Our <a href="/penetration-testing/infrastructure">infrastructure testing</a> assesses DDoS resilience and mitigation strategy.
Attribution Remains Unknown
No group claimed responsibility and no public attribution was made. DDoS attacks are inherently difficult to attribute because they can be launched through botnets, amplification, and proxied infrastructure. <a href="https://www.cyber-defence.io/services/threat-intelligence">UK Cyber Defence's threat intelligence</a> provides attribution analysis for attacks against UK organisations.
All Parties at Risk
While Labour was targeted in this instance, all UK political parties, campaign organisations, and electoral bodies face similar risks. The NCSC issued guidance to political parties on cyber protection during elections. <a href="/cyber-essentials">Cyber Essentials certification</a> provides the baseline security that all political organisations should implement.

Democratic processes require cyber resilience.

The Labour Party DDoS attacks established that UK elections face active cyber threats. For political parties, campaign organisations, local authorities administering elections, and any organisation involved in democratic processes, cyber resilience is not optional — it is a democratic obligation. Cyber Essentials provides the baseline. Infrastructure testing assesses DDoS resilience. SOC in a Box provides 24/7 monitoring during high-threat periods. And UK Cyber Defence provides incident response when democratic infrastructure is targeted.


A DDoS attack on a UK political party during a general election. Is your democratic infrastructure resilient?

<a href="/penetration-testing/infrastructure">Infrastructure testing</a> assesses DDoS resilience. <a href="/cyber-essentials">Cyber Essentials</a> provides the baseline. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors during elections.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles