Scottish MP Stewart McDonald fears emails hacked by Russia-linked group

An SNP MP whose emails were hacked has spoken out because he fears they were stolen by a group linked to Russia and will be published.

Stewart McDonald’s emails were compromised last month after he clicked on a message from a member of his staff on his private MP’s account.

The MP for Glasgow South was the defence spokesperson for the SNP until last year and has followed Ukraine closely, receiving the country’s order of merit in 2019.

A group known as Seaborgium is believed to be responsible for the attack, according to the BBC. It has been linked to Russian security services and has conducted a targeted campaign against high-profile figures, including politicians, activists and journalists.

In a post on Twitter on Wednesday morning, McDonald said: “Over the past couple of weeks I have been dealing with a sophisticated and targeted spear phishing hack of my personal email account, and the personal email account belonging to one of my staff. These hacks are a criminal offence.”

The sophisticated hack happened when McDonald opened an email on 13 January from a staff member’s genuine account. It claimed to contain a password protected document with a military update on Ukraine and brought up the log-in page for his email account, which he filled in.

The document turned out to be a blank page and when, a few days later, the staff member was locked out of his personal account because of suspicious activity, they spoke and discovered he had never sent the email.

McDonald reported the matter to the Cyber Security Centre, an arm of the UK’s intelligence agency, GCHQ.

He said he wanted to go public about the spear phishing attack to warn others and to pre-empt the publication of real or fake emails from his account.

“If it is indeed a malicious state-backed group, then, in line with what I’ve seen elsewhere, I expect them to dump some of the information online.

“And I can expect them to manipulate and fake some of that content and I want to get out ahead of that to ensure any disinformation attack against me is discredited before it’s even published,” he told the BBC.

McDonald reassured his constituents on Twitter that the issue would not affect their messages to his official account.

“Although attempts to hack my parliamentary account are continuous – as is the case for all MPs – these have not been successful,” he said. “I want to assure constituents that their information is secure. My private account is not used for constituency or parliamentary business.”