Scottish parliament hit by cyber-attack similar to Westminster assault

Hackers have mounted a “brute force” cyber-attack on the Scottish parliament’s computer systems, weeks after a similar attack on email accounts at Westminster.

MSPs and Holyrood staff were warned on Tuesday that hackers were attempting to access numerous email accounts by systematically and repeatedly trying to crack their passwords.

Holyrood officials said they were not aware of any compromised email accounts, but staff and MSPs were warned the attack could mean some people were locked out of their accounts.

The attack follows a sustained assault on computers at Westminster in June, which security officials blamed on the Russian government. In that incident, up to 90 email accounts with weak passwords were accessed.

In an internal bulletin, Sir Paul Grice, Holyrood’s chief executive, told MSPs and parliamentary staff on Tuesday afternoon: “The parliament’s monitoring systems have identified that we are currently the subject of a brute force cyber-attack from external sources.

“This attack appears to be targeting parliamentary IT accounts in a similar way to that which affected the Westminster parliament in June. Symptoms of the attack include account lockouts or failed log-ins.

“The parliament’s robust cybersecurity measures identified this attack at an early stage and the additional security measures which we have in readiness for such situations have already been invoked. Our IT systems remain fully operational.”

Grice urged staff and MSPs to update their passwords with longer and stronger combinations of letters, numbers and special characters. He said Holyrood’s IT staff had done a sweep of passwords used and found too many were weak and easily unpicked.

That survey “has highlighted a much higher than expected level of ‘simple’ passwords which would be easy to guess/crack using software which can be easily obtained. The number of simple passwords identified is too high for us to contact each individual personally,” he said.

After the attack on Westminster’s systems in June, officials there said the hackers had obtained access to those emails – which accounted for less than 1% of the 9,000 email addresses used at Westminster – because they had weak passwords.

MPs said suspicion had fallen on Russian or North Korean agencies, which have previously been accused of attacking the UK. Moscow was believed to be the most likely culprit.

Russia has also been linked to attacks on political parties in France during this year’s presidential elections and on the Democrats in the US during last year’s presidential campaign.