Parliament has been hit by a “sustained and determined” cyber-attack by hackers attempting to gain access to MPs’ and their staffers’ email accounts. Both houses of parliament were targeted on Friday in an attack that sought to gain access to accounts protected by weak passwords. MPs said they were unable to access their emails after the attack began.
The estate’s digital services team said they had made changes to accounts to block out the hackers, and that the changes could mean staff were unable to access their emails.
An email sent to all those affected, seen by the Guardian, said: “Earlier this morning, we discovered unusual activity and evidence of an attempted cyber-attack on our computer network. Closer investigation by our team confirmed that hackers were carrying out a sustained and determined attack on all parliamentary user accounts in an attempt to identify weak passwords.
“These attempts specifically were trying to gain access to our emails. We have been working closely with the National Cyber Security Centre to identify the method of the attack and have made changes to prevent the attackers gaining access, however our investigation continues.”
The changes are believed to have stopped MPs and their offices from accessing emails on mobile phones and tablets outside Westminster. “Access to systems from the Westminster estate has not been affected,” the email said, before adding that further disruption was likely.
The Liberal Democrat peer Chris Rennard said a “cybersecurity attack on Westminster parliamentary emails” meant that access to accounts may be restricted.
Henry Smith, the Conservative MP for Crawley, said on Twitter: “Sorry, no parliamentary email access today – we’re under cyber-attack from Kim Jong-un, Putin or a kid in his mom’s basement or something.”
The international trade secretary, Liam Fox, told ITV News the attack was a “warning to everyone we need more security and better passwords. You wouldn’t leave your door open at night”.
In an interview with the BBC, he added: “We know that there are regular attacks by hackers attempting to get passwords. We have seen reports in the last few days of even Cabinet ministers’ passwords being for sale online. We know that our public services are attacked, so it is not at all surprising that there should be an attempt to hack into parliamentary emails.”
A House of Commons spokesperson said: “The Houses of Parliament have discovered unauthorised attempts to access parliamentary user accounts. We are continuing to investigate this incident and take further measures to secure the computer network, liaising with the National Cyber Security Centre (NCSC).
“We have systems in place to protect member and staff accounts and are taking the necessary steps to protect our systems.”
They said the lack of remote access for users was not part of the attack but a result to protection measures dealing with the incident. “Parliament has disabled remote access to protect the network.”
The National Crime Agency said it was working with the NCSC on the issue. It tweeted:
NationalCrimeAgency
(@NCA_UK)We’re aware of a possible cyber incident affecting parliament are actively cooperating with @ncsc who’re leading the operational response pic.twitter.com/YOvPwQvn37
Speaking at the Glastonbury festival, where he had given two speeches to the assembled revellers, the Labour leader, Jeremy Corbyn, said: “I think [this] indicates just how vulnerable we are to cyber-attacks and our cyber-security.
“We need to be investing in cyber-protection – it is a huge issue. We all rely on computers, we all rely on emails, we all rely on digital records. You wouldn’t leave your building without importing documents under lock and key. A computer is just the same.”
