> series: anatomy_of_a_breach —— part: 103 —— target: uk_parliament —— accounts: ~90 —— method: brute_force_weak_passwords<span class="cursor-blink">_</span>_
On 23 June 2017, the UK Parliamentary Digital Service disclosed that it was dealing with a sustained cyber attack targeting parliamentary email accounts. Remote email access was temporarily disabled for security reasons, affecting MPs, peers, and their staff. Approximately 90 accounts — less than 1% of the roughly 9,000 parliamentary email users — were compromised through the attack, which used brute-force password guessing and credential-stuffing techniques.
The attack came just six weeks after WannaCry had devastated the NHS and amid heightened concerns about foreign interference in democratic processes following the DNC hack. Reports suggested the attack may have been linked to Iran, though attribution was not confirmed. The 90 compromised accounts were those using weak passwords that had not been protected by multi-factor authentication — the same fundamental failure documented in breaches throughout this series.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe parliamentary email system did not mandate MFA at the time of the attack — and the 90 compromised accounts were protected only by passwords that were weak enough to be guessed or matched from breach databases. This is the credential-stuffing pattern documented in Breach #091: passwords compromised in previous breaches (LinkedIn, Myspace, etc.) tested against new targets — succeeding wherever users had reused the same password.
The UK Parliament attack reinforced — in the most politically visible way possible — that MFA must be mandatory for all users, not an opt-in feature. The 90 compromised accounts were the ones that had not enabled MFA. If MFA had been enforced for all parliamentary users, the attack would have affected zero accounts instead of 90. Cyber Essentials Danzell makes MFA an auto-fail criterion for exactly this reason.
Our penetration testing includes credential-testing scenarios and MFA bypass assessment. Social engineering assessments test staff resilience to phishing. SOC in a Box monitors for brute-force and credential-stuffing patterns. And UK Cyber Defence provides incident response when authentication attacks are detected.
<a href="/cyber-essentials">Cyber Essentials</a> mandates MFA. Our <a href="/penetration-testing">penetration testing</a> validates enforcement. <a href="https://www.socinabox.co.uk">SOC in a Box</a> detects credential attacks.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call