Report: Russian hackers steal credentials of British officials and offer them on the dark web

Extent of the affected accounts

According to a list of compromised accounts obtained by the "Telegraph," credentials of employees of the Foreign Office abroad and of local authority officials across Great Britain were harvested. Among the affected municipalities are, according to the report, the central English county of Derbyshire and the London borough of Waltham Forest. IT staff at British embassies in Mauritius are also said to be among those affected.

Among the credentials being offered for sale are, according to the report, login details for the National Health Service (NHS), energy suppliers, and important pharmaceutical suppliers across the country. On dark-web forums, the credentials are being offered for sale. This poses a concrete risk that further attackers will use the stolen information for follow-up offences.

Indications of Russian attackers

State Russian involvement in the attack has not, according to the assessment of security experts, been proven to date. Security researchers have likewise, according to the "Telegraph," not yet presented evidence of a direct link to Russian state bodies. The attribution is based, according to the report, on traces pointing to Russian-speaking attackers, but has not been conclusively proven.

The "FortiBleed" method targets a vulnerability in security systems that are widely used in authorities and businesses. By combining it with previously stolen data, the attackers were able, according to the "Telegraph," to bypass protective measures that are actually intended to prevent unauthorised access to critical infrastructure. The incident therefore raises questions about the resilience of the security solutions used.

Risks for local authorities and critical infrastructure

According to the information available, the affected parties are explicitly not only central government agencies, but also the local government level. Local authority officials in Great Britain process sensitive data relating, for example, to social benefits, planning applications, and local health services. Access to these accounts could therefore have far-reaching consequences for the protection of personal information.

Reactions and recommendations

The "Telegraph" cites a list of compromised accounts as well as analyses by security researchers. The British government has not yet publicly commented on the report. The Foreign Office also declined to comment on the allegations when approached by the newspaper.

Security experts recommend that affected authorities treat all credentials as compromised, change passwords immediately, and monitor access to critical systems more closely. The "Telegraph" also advises closely monitoring the sale of the data on dark-web forums in order to detect further attacks at an early stage.